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FOREWORD 

One  of  my  highest  priorities  as  the  Defense  Inspector  General  is  to 
encourage  the  effective  use  of  DoD  audit,  investigative  and  inspection  resources. 
Cooperation  is  one  of  the  most  important  ways  to  achieve  this  goal  because  it 
can  help  eliminate  duplication  of  audit  work  and  increase  sharing  of  audit 
techniques  and  results.  I  believe  uniformity  of  audit  policy  and  of  certain 
operating  procedures  can  facilitate  the  free  and  open  exchange  of  ideas  which 
is  so  essential  to  effective  cooperation.  Put  simply,  we  can  communicate 
better  if  we  all  speak  the  same  language. 

The  purpose  of  this  manual  is  to  establish  uniform  policies  and  procedures 
so  we  will  all  be  able  to  speak  the  same  language.  In  addition,  it  is  designed 
to  help  DoD  auditors  and  internal  audit  and  internal  review  organizations  comply 
with  standards,  policies,  and  procedures  promulgated  by  the  Congress,  the 
Comptroller  General  of  the  United  States,  the  Office  of  Management  and  Budget, 
the  President's  Council  on  Integrity  and  Efficiency,  and  the  Department  of 
Defense . 

This  manual  is  issued  under  the  authority  of  DoD  Directive  7600.7,  "DoD 
Internal  Audit  Standards,  Policies,  and  Procedures,"  October  31,  1983.  It 
applies  to  the  Office  of  the  Secretary  of  Defense  (OSD),  the  Military  Depart¬ 
ments,  the  Organization  of  the  Joint  Chiefs  of  Staff,  the  Unified  and  Specified 
Commands,  and  the  Defense  Agencies  (hereafter  referred  to  collectively  as  "DoD 
Components") . 

The  manual  chapters  are  effective  when  published.  However,  because 
certain  provisions  may  require  major  changes  in  the  existing  policies  and 
procedures  of  the  DoD  internal  audit  and  internal  review  organizations,  each 
organization  will  be  allowed  a  reasonable  period  of  time  to  make  appropriate 
revisions  in  their  implementing  guidance. 

The  policy  contained  in  the  internal  audit  policy  memoranda  issued  by  the 
Inspector  General,  Department  of  Defense  (IG,  DoD)  will  be  incorporated  into 
this  manual.  Each  policy  memorandum  will  be  rescinded  when  the  appropriate 
manual  chapter  is  published. 

Forward  recommended  changes  to  this  manual  through  channels  to: 

Office  of  the  Assistant  Inspector  General 
■  for  Audit  Policy  and  Oversight 
Office  of  the  Inspector  General 
Department  of  Defense 
Room  1E463,  Pentagoii 
Washington,  D.C.  20301 
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DoD  Components  may  obtain  copies  of  this  manual  through  their  own  publica 
tion  channels.  Other  Federal  agencies  and  the  public  may  obtain  copies  from 
the  U.S.  Department  of  Commerce,  National  Technical  Information  Service, 

5285  Port  Royal  Road,  Springfield,  Virginia  22161. 
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CHAPTER  1 
GENERAL 


A.  PURPOSE 


This  manual  provides  general  guidance  on  the  standards  and  policies  to 
be  followed  by  DoD  internal  auditors  in  the  performance  of  their  audit  mission, 
and  prescribes  procedures,  where  applicable,  to  ensure  uniformity  of 
implementation. 

B.  APPLICABILITY 

1.  This  manual  applies  to  all  DoD  internal  audit  and  internal  review 
organizations,  including  nonappropriated  fund  audit  organizations  (hereafter 
referred  to  collectively  as  "internal  audit  organizations"). 

2.  Certain  portions  of  this  manual  do  not  apply  to  internal  review  and 
nonappropriated  fund  audit  organizations.  Each  chapter  will  indicate  the 
applicability  of  the  provisions  of  that  chapter  to  all  types  of  audit 
organizations. 

C.  BACKGROUND 

1.  The  Inspector  General  Act  of  1978,  as  amended,  (reference  (a))  and 
the  Office  of  Management  and  Budget  (0MB)  Circular  A-73  (reference  (b)), 
require  the  IG,  DoD,  to  provide  policy  direction  for  audits  of  the  programs 
and  operations  of  the  Department  of  Defense.  In  carrying  out  these  policy 
formulation  responsibilities,  the  IG,  DoD,  also  is  required  to  ensure  that  DoD 
audits  comply  with  standards  established  by  the  Comptroller  General  of  the 
United  States  (reference  (c)). 

2.  The  DoD  Directive  7600.7  (reference  (d))  requires  the  IG,  DoD,  to  (a) 
develop  uniform  standards,  policies,  and  procedures  to  improve  the  efficiency 
and  effectiveness  of  DoD  internal  audit  activities  and  (b)  provide  a  consistent 
basis  for  measuring  the  quality  and  effectiveness  of  internal  audit  operations. 
As  part  of  these  responsibilities,  the  IG,  DoD,  is  responsible  for  developing, 
publishing,  and  maintaining  an  internal  audit  manual  setting  forth  the  uniform 
standards,  policies,  and  procedures.  In  addition,  the  regulation  requires 

the  DoD  Components  to  develop  the  detailed  procedures  required  to  implement 
the  internal  audit  policy  manual. 

D.  EFFECTIVE  DATE 

1.  The  chapters  in  this  manual  are  effective  when  issued.  However, 
because  certain  provisions  of  this  manual  may  require  major  changes  in  the 
existing  policies  and  procedures  of  the  DoD  internal  audit  organizations,  the 
individual  organizations  will  be  allowed  a  reasonable  period  of  time  to  make 
appropriate  revisions  in  their  implementing  guidance. 
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CHAPTER  2 

DOD  INTERNAL  AUDITING  STANDARDS 


A.  PURPOSE 

The  purpose  of  this  chapter  is  to  prescribe  the  auditing  standards  that 
shall  be  followed  by  DoD  internal  audit  organizations  and  auditors  in  the 
management  and  performance  of  auditing  activities. 

B.  APPLICABILITY 


The  provisions  of  this  chapter  are  mandatory  for  all  DoD  internal  audit 
and  internal  review  organizations,  including  nonappropriated  fund  audit 
organizations  (hereafter  referred  to  collectively  as  "internal  audit 
organizations") . 

C.  BACKGROUND 

1.  The  level  of  acceptance  and  confidence  in  audit  work  by  management  and 
external  bodies  is  largely  dependent  upon  the  quality  and  reliability  of  such 
work.  Properly  developed  standards  provide  criteria  by  which  the  quality  and 
efficiency  of  an  audit  organization  may  be  evaluated  and  measured.  The  exist¬ 
ence  and  use  of  standards  by  audit  organizations  distinguish  these  organizations 
from  other  DoD  review  and  oversight  activities.  The  Inspector  General  Act  of 
1978,  as  amended  (reference  (a)),  requires  all  DoD  internal  audit  organizations 
to  adhere  to  auditing  standards  issued  by  the  Comptroller  General  of  the  United 
States  (reference  (c)).  These  standards  relate  to  the  scope  and  quality  of 
audit  efforts  and  to  the  characteristics  of  professional  and  meaningful  audit 
reports.  The  statements  on  auditing  standards  and  other  pronouncements  issued 
by  the  American  Institute  of  Certified  Public  Accountants  are  incorporated  into 
reference  (a)  unless  specifically  excluded  by  a  formal  announcement  from  the 
General  Accounting  Office  (GAO). 

2.  The  Institute  of  Internal  Auditors  (IIA)  and  the  President's  Council 
on  Integrity  and  Efficiency  (PCIE)  also  have  promulgated  standards  (references 
(e)  and  (f))  applicable  to  audit  activities.  The  IIA  and  PCIE  standards  are 
compatible  with  those  issued  by  the  Comptroller  General  of  the  United  States 
(reference  (c)).  While  reference  (c)  deals  primarily  with  the  performance  of 
individual  audit  projects,  references  (e)  and  (f)  provide  guidelines  for  the 
management  of  both  audit  projects  and  audit  organizations. 

3.  Office  of  Management  and  Budget  Circular  A-73  (reference  (b))  also 
provides  guidance  applicable  to  DoD  internal  audit  organizations.  Reference 
(b)  concentrates  on  the  areas  of  organization  and  staffing  of  audit  activities, 
determination  of  audit  priorities,  formulation  of  audit  plans,  and  coordination 
of  audit  work. 
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D.  DOD  AUDITING  STANDARDS 


The  auditing  standards  to  be  followed  by  DoD  internal  audit  organizations 
and  auditors  are  a  compilation  of  auditing  standards  issued  by  the  0MB,  Comp¬ 
troller  General,  IIA  and  PCIE  (references  (b) ,  (c) ,  (e) ,  and  (f).  The  DoD 
auditing  standards  are  comprised  of  6  general  standards  and  34  specific 
standards.  The  six  general  standards  are  as  follows: 

100  INDEPENDENCE  -  The  internal  audit  organization  and  the 

individual  auditors  must  be  free  from  personal,  external, 
or  organizational  impairments  and  consistently  shall 
maintain  an  independent  attitude  and  appearance. 

1 10  Personal  Impairments  -  In  some  circujnstances ,  auditors 
cannot  be  impartial  because  of  their  views  or  personal 
situation.  While  these  impairments  apply  to  individual 
auditors,  they  also  may  apply  to  the  internal  audit 
organization.  These  circumstances  include,  but  are  not 
limited  to,  the  following: 

1.  Official,  professional,  personal,  or  financial 
relationships  that  may  cause  the  auditor  to  Ijmit 
the  extent  of  the  inquiry,  to  limit  disclosure,  or 
to  weaken  audit  findings  in  any  way. 

2.  Preconceived  ideas  about  individuals,  groups, 
organizations,  or  objectives  of  a  particular 
program  that  could  bias  the  audit. 

3.  Previous  involvement  in  a  decisionmaking  or 
management  capacity  that  would  affect  current 
operations  of  the  entity  or  program  being  audited. 

4.  Biases,  including  those  induced  by  political  or 
social  convictions,  that  result  from  employment 
in,  or  loyalty  to,  a  particular  group, 
organization,  or  level  of  Government. 

5.  Subsequent  performance  of  an  audit  by  the  same 
individual  who,  for  example,  previously  had 
approved  invoices,  payrolls,  claims,  and  other 
proposed  payments. 

6.  Subsequent  performance  of  an  audit  by  the  same 
individual  who  maintained  the  official  accounting 
records . 

7.  Financial  interests,  direct  or  substantially 
indirect,  in  the  audited  entity  or  program. 
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120  External  Impairments  -  Factors  external  to  the  internal  audit 
organization  can  restrict  the  audit  or  interfere  with  the  auditor's 
ability  to  form  independent  and  objective  opinions  and  conclusions. 

For  example,  under  the  following  conditions,  an  audit  will  be  affected 
adversely  and  the  auditor  will  not  have  complete  freedom  to  make  an 
independent  and  objective  judgment: 

1.  Undue  interference  in  the  recruitment  and  assignment  of 
audit  personnel. 

2.  Undue  restrictions  on  funds  or  other  resources 
dedicated  to  the  internal  audit  organization  that 
could  prevent  the  auditors  from  performing 
essential  work. 

3.  Authority  to  overrule  or  to  unduly  influence  the 
auditor's  judgment  as  to  selection  of  what  is  to 
be  audited,  determination  of  the  scope  and  timing 
of  work  or  approach  to  be  used,  content  of  any 
resulting  report,  or  resolution  of  audit  findings. 

4.  Influences  that  jeopardize  the  auditor's  continued 
employment  for  reasons  other  than  competency  or 
the  need  for  audit  services. 

5.  Interference  with  access  to  all  records,  reports, 
audits,  reviews,  documents,  papers,  recommenda¬ 
tions,  or  other  material  needed  to  carry  out  the 
audit  or  denial  of  opportunity  to  obtain  explana¬ 
tions  from  officials  and  employees. 

6.  Political  pressures  that  affect  the  selection  of 
areas  for  audit,  the  performance  of  those  audits, 
and  the  reporting  of  conclusions  objectively 
without  fear  of  censure. 

130  Scope  Impairments  -  When  factors  external  to  the  internal  audit 

organization  and  the  auditor  restrict  the  audit  or  interfere  with 
the  auditor's  ability  to  form  objective  opinions  and  conclusions, 
the  auditor  shall  attempt  to  remove  the  limitation  or,  failing 
that,  appropriately  qualify  the  resulting  audit  report. 

140  Organizational  Placement  -  The  DoD  internal  audit  organizations 
shall  report  to  the  head  or  deputy  head  of  the  agency  and  shall 
be  organizationally  located  outside  the  staff  or  line  management 
function  of  the  activities  or  functions  under  audit. 

150  Objectivity  -  Auditors  shall  be  objective  in  performing  audits. 

1.  Objectivity  is  an  independent  mental  attitude  which  auditors 
shall  maintain  in  performing  audits.  Auditors  are  not  to 
subordinate  their  judgment  on  audit  matters  to  that  of  others. 
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2. 


The  auditor's  objectivity  is  not  adversely  affected  when  the 
auditor  recommends  standards  of  control  for  systems  or  reviews 
procedures  before  they  are  implemented.  Designing,  installing 
and  operating  systems  are  not  audit  functions.  Also,  the 
drafting  of  procedures  for  systems  is  not  an  audit  function. 
Performing  such  activities  is  presumed  to  impair  audit 
objectivity. 

200  PROFESSIONAL  PROFICIENCY  -  Professional  proficiency  is  the  responsibility 
of  the  internal  audit  organization  and  eacn  auditor.  The  internal  audit 
organization  shall  assign  to  each  audit  those  persons  who  collectively 
possess  the  necessary  knowledge,  skills,  and  disciplines  to  conduct  the 
audit  properly. 

210  Due  Professional  Care  -  Due  professional  care  is  to  be  used  in 

conducting  the  audit  and  in  preparing  the  related  reports . 

1.  The  internal  audit  organization  and  the  auditor  are  responsible 
for  employing  professional  standards  in  auditing  Government 
organizations,  programs,  activities,  and  functions. 

2.  Due  professional  care  calls  for  the  application  of  the  care  and 
skill  expected  of  a  reasonably  prudent  and  competent  auditor  in 
the  same  or  similar  circumstances.  Professional  care  should, 
therefore,  be  appropriate  to  the  complexities  of  the  audit 
being  performed.  In  exercising  due  professional  care,  auditors 
shall  be  alert  to  the  possibility  of  intentional  wrongdoing, 
errors  and  omissions,  inefficiency,  waste,  ineffectiveness, 

and  conflicts  of  interest.  They  also  shall  be  alert  to  those 
conditions  and  activities  where  irregularities  are  most  likely 
to  occur.  In  addition,  they  shall  identify  inadequate  controls 
and  recommend  improvements  to  promote  compliance  with  accept¬ 
able  procedures  and  practices. 

3.  Due  care  implies  reasonable  care  and  competence,  not  infallibil¬ 
ity  or  extraordinary  performance.  Due  care  requires  the  auditor 
to  conduct  examinations  and  verification  to  a  reasonable  extent, 
but  does  not  require  detailed  audits  of  all  transactions. 
Accordingly,  the  auditor  cannot  give  absolute  assurance  that 
noncompliance  or  irregularities  do  not  exist.  Nevertheless,  the 
possibility  of  material  irregularities  or  noncompliance  shall  be 
considered  whenever  the  auditor  undertakes  an  auditing  assignment 

4.  When  an  auditor  suspects  fraud  or  other  illegal  acts,  the 
appropriate  DoD  criminal  investigative  organization  shall  be 
informed . 

5.  Exercising  due  professional  care  means  using  good  judgment  in 
choosing  tests  and  procedures  and  in  preparing  reports.  To  this 
end,  the  auditor  shall  consider  the  following: 

a . 


Extent  of  audit  work  needed  to  achieve  audit  objectives. 
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b.  Relative  materiality  or  significance  of  matters  to  which 
audit  procedures  are  applied. 

c.  Adequacy  and  effectiveness  of  internal  controls. 

d.  Cost  of  auditing  in  relation  to  potential  benefits. 

220  Auditor  Qualifications  -  Auditors  shall  possess  the  knowledge, 

skills,  and  disciplines  essential  to  the  performance  of  audits. 

Each  auditor  shall  possess  certain  knowledge  and  skills  as  follows 

1.  Proficiency  in  applying  internal  auditing  standards, 
procedures,  and  techniques  is  required  in  performing 
audits.  Proficiency  means  the  ability  to  apply  knowledge 
to  situations  likely  to  be  encountered  and  to  deal  with 
them  without  extensive  recourse  to  technical  research  and 
assistance . 

2.  Proficiency  in  accounting  principles  and  techniques  is 
required  for  auditors  who  work  extensively  with  financial 
records  and  reports. 

3.  An  understanding  of  management  principles  is  required  to 
recognize  and  evaluate  the  materiality  and  significance  of 
deviations  from  good  business  practices.  An  understanding 
means  the  ability  to  apply  broad  knowledge  to  situations 
likely  to  be  encountered,  to  recognize  significant 
deviations,  and  to  be  able  to  carry  out  the  research 
necessary  to  arrive  at  reasonable  solutions. 

4.  An  appreciation  is  required  of  the  fundamentals  of  such 
subjects  as  accounting,  economics,  quantitative  methods, 
and  computerized  information  systems. 

5.  A  knowledge  of  directives  and  other  issuances  from  GAO, 

OHB,  Department  of  Defense,  the  Congress,  or  other 
authoritative  bodies. 

6.  A  working  familiarity  with  the  organizations,  programs, 
activities,  and  functions  of  each  major  DoD  Component 
subject  to  audit,  in  sufficient  depth  to  knowledgeably 
assess  that  Component's  mission  accomplishment  and  to 
identify  problems  to  the  degree  required  for  a  particular 
task  or  set  of  duties. 

7.  A  knowledge  of  Government  policies,  requirements,  and 
guidelines  related  to  a  particular  task. 


8.  Managerial  skills  for  supervisors  and  team  leaders. 


230  Human  Relations  and  Communications  -  Auditors  shall  be  skilled  in 
dealing  with  people  and  in  communicating  effectively. 

1.  Auditors  shall  understand  human  relations  and  maintain 
satisfactory  relationships  with  auditees. 

2.  Auditors  shall  be  skilled  in  oral  and  written  communications 
so  that  they  can  convey  clearly  and  effectively  such  matters 
as  audit  objectives,  evaluations,  conclusions,  and  recommen¬ 
dations  . 

240  Continuing  Education  -  Auditors  shall  maintain  their  technical 
competence  through  continuing  education.  Auditors  are  respon¬ 
sible  for  continuing  their  education  to  maintain  their  proficiency. 
They  should  keep  informed  about  improvements  and  current  develop¬ 
ments  in  auditing  standards,  procedures,  and  techniques.  Con¬ 
tinuing  education  may  be  obtained  through  membership  and  partici¬ 
pation  in  professional  societies;  attendance  at  seminars,  college 
courses,  and  Federal  and  in-house  training  programs;  and  partici¬ 
pation  in  research  projects. 

250  Compliance  with  Standards  of  Conduct  -  Auditors  shall  comply  with 
professional  standards  of  conduct.  Auditors  shall  maintain  high 
standards  of  honesty,  objectivity,  diligence  and  loyalty  in  the 
performance  of  their  work. 

300  SCOPE  OF  AUDIT  WORK  -  The  scope  of  each  audit  shall  include  an  evaluation 
of  the  adequacy  and  effectiveness  of  the  organization’s  system  of  internal 
accounting  and  administrative  controls  and  of  the  quality  of  performance 
in  carrying  out  assigned  responsibilities. 

310  Reliability  and  Integrity  of  Information  -  Auditors  shall  review  the 
reliability  and  integrity  of  financial  operating  information  and  the 
means  used  to  identify,  measure,  classify,  and  report  such  informa¬ 
tion.  Information  systems  provide  data  for  decision-making,  control, 
and  compliance  with  external  requirements.  Therefore,  auditors  shall 
examine  information  systems  and,  as  appropriate,  ascertain  whether 
the  following  apply: 

1.  Financial  and  operating  records  and  reports  contain  accurate, 
reliable,  timely,  complete,  and  useful  information. 

2.  Controls  over  record  keeping  and  reporting  are  adequate  and 
effective . 


320  Compliance  with  Policies,  Plans,  Procedures,  Laws,  and  Regulations  - 
Auditors  shall  review  the  systems  established  to  ensure  compliance 
with  those  policies,  plans,  procedures,  laws  and  regulations  that 
could  have  a  significant  impact  on  operations  and  reports,  and 
should  determine  whether  the  organization  is  in  compliance. 
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1.  Management  is  responsible  for  establishing  the  systems  designed 
to  ensure  compliance  with  such  requirements  as  policies,  plans, 
procedures,  and  applicable  law  and  regulations.  Auditors  are 
responsible  for  determining  whether  the  systems  are  adequate  and 
effective  and  whether  the  activities  audited  are  complying  with 
the  appropriate  requirements . 

2.  The  auditor  shall  determine  whether  the  financial  statements  of 
an  audit  entity  fairly  present  the  financial  position  and  the 
results  of  financial  operations  in  accordance  with  accounting 
principles  and  standards  prescribed  by  the  Comptroller  General. 

330  Safeguarding  of  Assets  -  Auditors  shall  review  the  means  of 

safeguarding  assets  and,  as  appropriate,  verify  the  existence 
of  such  assets. 

1.  Auditors  shall  review  the  means  used  to  safeguard  assets  from 
various  types  of  losses,  such  as  those  resulting  from  theft, 
fire,  improper  or  illegal  activities,  and  exposure  to  the 
elements . 

2.  Auditors,  when  verifying  the  existence  of  assets,  shall  use 
appropriate  audit  procedures. 

340  Economical  and  Efficient  Use  of  Resources  -  Auditors  shall  appraise 
the  economy  and  efficiency  with  which  resources  are  managed. 

1.  Management  is  responsible  for  setting  operating  standards  to 
measure  an  entity's  economical  and  efficient  use  of  resources. 
Auditors  are  responsible  for  determining  the  following: 

a.  Whether  operating  standards  have  been  established  for 
measuring  economy  and  efficiency. 

b.  Whether  established  operating  standards  are  understood  and 
are  being  met. 
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Whether  deviations  from  operating  standards  are  identified, 
analyzed,  and  conununicated  to  those  responsible  for 
corrective  action. 


Whether  corrective  action  has  been  taken. 


2.  Audits  related  to  the  economical  and  efficient  use  of  resources 
shall  identify  the  following  conditions: 

a.  Underutilized  facilities. 

b.  Nonproductive  work. 

c.  Procedures  that  are  not  cost  effective. 

d.  Overstaffing  and  understaffing. 

e.  Unneeded  or  costly  procurements. 


350  Accomplishment  of  Established  Objectives  and  Goals  for  Operations 
and  Programs  -  Auditors  shall  review  operations  and  programs  to 
ascertain  whether  results  are  consistent  with  established  objec¬ 
tives  and  goals  and  whether  the  operations  or  programs  are  being 
carried  out  as  planned.  Management  is  responsible  for  establishing 
operating  or  program  objectives  and  goals,  developing  and  imple¬ 
menting  control  procedures,  and  accomplishing  desired  operating  or 
program  results.  The  auditor  shall  determine  whether  the  desired 
results  or  benefits  are  being  achieved  and  whether  the  entity  has 
considered  alternatives  that  might  yield  desired  results  at  a  lower 
cost . 

400  PERFORMANCE  OF  AUDIT  WORK  -  The  auditor  is  responsible  for  planning  and 
conducting  the  audit  assignment,  subject  to  supervisory  review  and 
approval. 

410  Planning  the  Audit  -  Auditors  shall  plan  each  audit.  Planning  shall 
be  documented  and  include  the  following: 

1.  Establishment  of  audit  objectives  and  scope  of  work. 

2.  Background  information  about  the  activities  to  be  audited. 

3.  Resources  necessary  to  perform  the  audit. 

4.  Communication  with  all  who  need  to  know  about  the  audit. 

5.  On-site  surveys  to  become  familiar  with  the  activities  and 

controls  to  be  audited,  to  identify  areas  for  audit  emphasis 
and  to  invite  auditee  comments  and  suggestions. 

6.  Determination  of  bow,  when,  and  to  whom  audit  results  will  be 
communicated . 

7.  Approval  of  the  audit  work  plan. 

8.  Coordination  with  other  Government  auditors,  when  appropriate, 
including  work  already  done  and  other  work  that  may  be  intended 
in  the  future. 

420  Audit  Program  -  A  written  audit  program  is  essential  to  conducting 
audits  efficiently  and  effectively  and  shall  be  prepared  for  each 
audit.  The  audit  program  generally  shall  include  the  following 
information : 

1.  Introduction  and  background. 


2.  Purpose  and  scope  of  audit. 
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4.  Definition  of  terms. 

5.  Special  instructions. 

6.  Audit  procedures. 

7.  Format  and  general  content  of  the  report  to  be  issued. 

430  Supervision  -  The  internal  audit  organization  shall  ensure  that 

audits  are  supervised  properly.  Supervision  shall  be  exercised  at 
each  level  of  the  internal  audit  organization  to  provide  quality 
control  over  audit  assignments. 

1.  Supervision  is  a  continuing  process,  beginning  with  planning  and 
ending  with  the  preparation  of  the  final  audit  report. 

2.  Supervision  includes  the  following: 

a.  Providing  suitable  instructions  to  subordinates  at  the 
beginning  of  the  audit  and  approving  the  audit  program. 

b.  Seeing  that  the  approved  audit  program  is  carried  out, 
unless  deviations  are  both  justified  and  authorized. 

c.  Ensuring  that  the  audit  is  performed  in  conformance  with 
professional  auditing  standards. 

d.  Determining  that  audit  working  papers  adequately  support 
the  audit  findings,  conclusions,  and  reports. 

e.  Ensuring  that  audit  reports  are  accurate,  objective,  clear, 
concise,  constructive,  and  timely. 

f.  Providing  that  the  work  assignments  are  commensurate  with 
the  abilities  of  the  assigned  staff. 

g.  Determining  that  audit  objectives  are  being  met. 

3.  Supervision  includes  sufficient  interim  checks  of  audit  work,  to 
determine  whether  audit  projects  are  on  schedule  and  are  being 
executed  in  accordance  with  plans,  so  that  necessary  adjustments 
can  be  made. 

4.  Appropriate  evidence  of  supervision  shall  be  documented  and 
retained. 


5. 


The  extent  of  supervision  required  will  depend  on  the 
proficiency  of  the  auditors  and  the  difficulty  of  the  audit 
assignment . 


6. 


All  auditing  assignments,  whether  performed  by  or  for  the 
audit  organization,  remain  the  responsibility  of  the  head 
of  the  internal  audit  organization. 


440  Examining  and  Evaluating  Information  -  Auditors  shall  collect, 

analyze,  interpret,  and  document  information  to  support  the  audit 
results . 

1.  Information  shall  be  collected  on  all  matters  related  to  the 
audit  objectives  and  scope  of  work. 

2.  Information  shall  be  sufficient,  competent,  and  relevant,  to 
provide  a  sound  basis  for  audit  findings  and  recommendations. 
"Sufficient"  information  is  factual,  adequate,  and  convincing 
so  that  a  prudent,  informed  person  would  reach  the  same  con¬ 
clusions  as  the  auditor.  "Competent"  information  is  reliable 
and  the  best  attainable  through  the  use  of  appropriate  audit 
techniques.  "Relevant"  information  supports  audit  findings 
and  recommendations  and  is  consistent  with  the  objectives  for 
the  audit. 

3.  Audit  procedures,  including  the  testing  and  qampling 
techniques  employed,  shall  be  selected  in  advance,  when 
practicable,  and  expanded  or  altered  if  circumstances 
warrant . 

4.  The  process  of  collecting,  analyzing,  interpreting,  and 
documenting  information  shall  be  supervised,  to  provide 
reasonable  assurance  that  the  auditor's  objectivity  is 
maintained  and  that  audit  goals  are  met. 

5.  Working  papers  that  document  the  audit  shall  be  prepared 
by  the  auditor  and  reviewed  by  audit  supervisory  personnel. 
These  working  papers  shall  record  the  information  obtained 
and  the  analyses  made,  and  shall  support  the  bases  for  the 
findings  and  recommendations  to  be  reported.  The  working 
papers  shall  be  complete,  accurate,  clear,  understandable, 
legible,  neat  and  contain  relevant  information. 

450  Internal  Controls  -  During  the  audit,  a  study  and  evaluation 
shall  be  made  of  the  internal  control  system  (accounting  and 
administrative  controls)  applicable  to  the  organization,  program, 
activity,  or  function  under  audit. 

460  Auditing  of  Computer-Based  Systems  -  The  auditor  shall  perform 
the  following: 

1.  Review  general  controls  in  data  processing  systems,  to 
determine  whether  (a)  the  controls  have  been  designed 
according  to  management  direction  and  known  legal  require¬ 
ments,  and  (b)  the  controls  are  operating  effectively  to 
provide  reliability  of,  and  security  over,  the  data  being 
processed . 
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2.  Review  application  controls  of  installed  data  processing 
applications  upon  which  the  auditor  is  relying,  to  assess 
their  reliability  in  processing  data  in  a  timely,  accurate, 
and  complete  manner. 

470  Fraud,  Abuse,  and  Illegal  Acts  -  Auditors  shall  be  alert  to  situations 
or  transactions  that  could  be  indicative  of  fraud,  abuse,  and  illegal 
expenditures  and  acts,  and  if  such  evidence  exists,  extend  audit 
steps  and  procedures  to  identify  the  effect  on  the  entity's  financial 
statements,  operations,  or  programs. 

480  Audit  Followup  -  Auditors  shall  follow  up  on  a  selective  basis  to 
ascertain  that  appropriate  corrective  action  was  taken  on  recom¬ 
mendations  in  Department  of  Defense  and  GAO  audit  reports. 

500  REPORTING  -  Auditors  shall  report  the  results  of  their 

audit  work  in  writing. 

510  Form  -  Written  reports  are  necessary  to  (a)  communicate  the  results 
of  audits  to  officials  at  all  levels  of  Government,  (b)  make  the 
findings  and  recommendations  less  susceptible  to  misunderstanding, 

(c)  make  the  findings  available  for  public  inspection,  and  (d) 
facilitate  followup  to  determine  whether  appropriate  corrective 
measures  have  been  taken. 

520  Distribution  -  Written  audit  reports  are  to  be  submitted  to  the 
appropriate  officials  of  the  organization  audited  and  to  the 
appropriate  officials  of  the  organizations  requiring  or  arranging 
for  the  audits,  unless  legal  restrictions  or  ethical  considerations 
prevent  it.  Copies  of  the  reports  also  shall  be  sent  to  other 
officials  who  may  be  responsible  for  taking  action  on  audit  findings 
and  recommendations  and  to  others  authorized  to  receive  such  reports. 
Unless  restricted  by  law  or  regulation,  copies  shall  be  made 
available  for  public  inspection. 

530  Timeliness  -  Reports  shall  be  issued  promptly  to  make  the  information 
available  for  timely  use  by  management  and  legislative  officials  and 
to  permit  prompt  initiation  of  following  action.  If  applicable 
reports  are  to  be  issued  on  or  before  the  date  specified  by 
regulation  or  other  special  arrangement. 

540  Report  Contents  -  The  audit  report  shall  include  the  following: 

1.  A  description  of  the  scope  and  objectives  of  the 
audit  and  background  information. 

2.  A  description  of  when  the  audit  was  performed  and 
the  period  covered  by  the  audit. 

3.  A  statement  that  the  audit  was  made  in  accordance 
with  auditing  standards  issued  by  the  Comptroller 
General  of  the  United  States,  as  implemented  by 
the  Inspector  General,  DoD. 


.  % , 


.  -i 

^  .-•i 


2-11 


A  statement  on  the  internal  controls  evaluated  and 
description  of  material  weaknesses  found  in  the 
internal  control  system  (accounting  and 
administrative  controls). 

A  specific  conclusion  on  each  of  the  stated  audit 
objectives . 

A  copy  of  any  financial  statements  reviewed,  an 
opinion  on  the  financial  statements,  and,  when 
appropriate,  a  statement  on  any  informative 
disclosures  included  in  the  financial  statements 
(applies  to  financial  and  compliance  audits  as 
defined  by  the  Comptroller  General  of  the  United 
States) . 

Photos,  charts,  graphs,  attachments,  and  exhibits 
when  they  contribute  to  the  clarity  of  the  audit 
report . 

Significant  instances  of  noncompliance  and 
instances  or  indications  of  fraud,  abuse,  or 
illegal  acts  found  during,  or  in  connection  with, 
the  audit.  However,  fraud  or  illegal  acts  shall 
be  covered  in  a  separate  report,  thus  permitting 
the  overall  report  to  be  released  to  the  public. 

Audit  findings  that  contain  each  of  the  following 
elements : 

a.  Criteria  -  The  standards,  measures,  or  expectations 
used  in  making  the  evaluation  or  verification  (what 
should  be). 

b.  Condition  -  The  factual  evidence  that  the  auditor  found  in 
the  course  of  the  examination  (what  is). 

c.  Cause  -  The  reason  for  the  difference  between  the  expected 
and  actual  conditions  (why  it  happened) . 

d.  Effect  -  The  risk  or  exposure  of  management  because  the 
condition  is  not  the  same  as  the  criteria  (the  impact  of 
the  difference). 

Specific  and  realistic  recommendations  for  actions  to  improve 
problem  areas  noted  in  the  audit  and  to  improve  operations. 

Pertinent  views  of  responsible  management  officials  concerning 
the  auditors'  findings,  conclusions,  and  recommendations.  Their 
views  shall  be  obtained  in  writing.  Management's  written 
comments  may  be  included  as  an  appendix  to  the  report  or 
presented  in  the  body  of  the  report. 
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12.  If  the  auditors  disagree  with  management's  views  on  the  audit 
recoimnendations ,  the  audit  report  shall  state  both  positions  and 
the  reasons  for  disagreement. 

13.  A  description  of  noteworthy  accomplishments,  particularly 
when  management  improvements  in  one  area  may  be  applicable 
elsewhere . 

14.  An  evaluation  of  any  corrective  actions  taken  by  management  in 
response  to  recommendations  in  prior  audits. 

15.  A  listing  of  any  issues  and  questions  needing  further  study 
and  consideration. 

16.  A  statement  as  to  whether  any  pertinent  information  has  been 
omitted  because  it  is  deemed  privileged  or  confidential.  The 
nature  of  such  information  shall  be  described,  and  the  law  or 
other  basis  under  which  it  is  withheld  shall  be  stated.  If  a 
separate  report  was  issued  containing  this  information,  it  shall 
be  indicated  in  the  report. 

550  Report  Presentation  -  The  audit  report  shall  conform  to  the  following 

guidelines : 

1.  Present  factual  data  accurately  and  fairly.  Include  only 
information,  findings,  and  conclusions  that  are  supported 
adequately  by  sufficient  evidence  in  the  auditors'  working 
papers . 

2.  Present  findings  and  conclusions  in  a  convincing  manner, 
distinguishing  clearly  between  facts  and  conclusions. 

3.  Be  objective,  unbiased,  and  free  from  distortion. 

4.  Be  written  in  language  as  clear  and  simple  as  the  subject  matter 
permits . 

5.  Be  concise  but,  at  the  same  time,  clear  enough  to  be  understood 
by  users. 

6.  Place  primary  emphasis  on  improvement  rather  than  on  criticism 
of  the  past.  Critical  comments  shall  be  presented  in  a  balanced 
perspective,  considering  any  unusual  difficulties  or  circum- 
stancer  faced  by  the  operating  officials  concerned. 

600  MANAGEMENT  OF  INTERNAL  AUDIT  ORGANIZATION  -  The  head  of  the  internal  audit 
organization  is  responsible  for  properly  managing  the  organization  so  that 
audit  work  fulfills  the  general  purposes  and  responsibilities  set  forth  in 
law  or  approved  by  the  head  or  deputy  head  of  the  agency;  resources  of  the 
internal  audit  organization  are  employed  efficiently  and  effectively;  and 
the  audit  work  conforms  to  DoD  auditing  standards,  policies,  and 
procedures . 
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610  Organization  -  The  head  of  the  internal  audit  organization  is 

responsible  for  properly  organizing  the  office  to  help  ensure  that 
the  resources  of  the  internal  audit  organization  are  deployed 
efficiently  and  effectively  to  fulfill  the  organization's  general 
purposes  and  responsibilities. 

1.  The  organizational  structure  shall  foster  coordinated, 
balanced,  and  integrated  accomplishment  of  the  organization's 
mission,  goals,  and  objectives. 

2.  Recruiting,  staffing,  and  training  shall  support  the  mission 
and  organizational  structure;  the  organization  should  not  be 
structured  around  available  skills.  Full  advantage  shall  be 
taken  of  those  skills  that  are  available. 

3.  The  internal  audit  organization  shall  reflect  the  unique 
audit  need  of  its  own  agency.  Whether  this  is  done  by 
function,  by  parallel  structure,  or  by  some  combination 
of  both,  the  way  in  which  each  office  is  organized  should 
simplify,  and  not  complicate,  the  ability  of  audit  personnel 
to  review  agency  programs  and  operations. 

620  Policies  and  Procedures  -  The  head  of  the  internal  audit  organi¬ 
zation  shall  provide  written  policies  and  procedures  to  guide 
the  audit  staff.  The  form  and  content  of  written  policies  and 
procedures  shall  be  appropriate  to  the  size  and  structure  of  the 
internal  audit  organization  and  the  complexity  of  its  work.  Formal 
administrative  and  technical  audit  manuals  may  not  be  needed  by 
all  internal  audit  organizations.  A  small  internal  audit  organi¬ 
zation  may  be  managed  informally.  In  a  large  internal  audit 
organization,  more  formal  and  comprehensive  policies  and  proce¬ 
dures  are  essential  to  guide  the  audit  staff  in  the  consistent 
compliance  with  the  organization's  standards  of  performance. 

630  Scope  of  Responsibility  -  Each  internal  audit  organization  shall 

maintain  records  of  its  audit  universe  that  identify  the  organiza¬ 
tions,  programs,  activities,  functions  and  systems  subject  to  audit. 

^0  Determination  of  Audit  Priorities  -  Each  internal  audit  organization 
shall  review  periodically  its  audit  universe  and  determine  the  cover¬ 
age,  frequency,  and  priority  of  audit  required  for  each.  The  review 
shall  include  consideration  of  the  following  factors: 

1.  Statutory  and  regulatory  requirements. 

2.  Adequacy  of  internal  accounting  and  administrative 
control  systems  as  indicated  by  vulnerability  assessments 
and  internal  control  reviews. 

3.  Newness,  changed  conditions,  or  sensitivity  of  the 
organization,  program  activity,  or  function. 
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4. 

Current  and  potential  dollar  magnitude. 

5. 

Extent  of  Federal  participation,  in  terms  of  resources  or 
regulatory  authority. 

6. 

Management  needs  to  be  met,  including  key  management  decision 
dates,  as  developed  in  consultation  with  the  responsible 
program  officials  and  senior  management. 

7. 

Prior  audit  experience. 

8. 

Timeliness,  reliability,  and  scope  of  audits  performed  by 
others . 

9. 

Results  of  other  evaluations,  such  as  inspections,  program 
reviews,  etc. 

10 

Availability  of  audit  resources. 

650  Planning  -  Each  internal  audit  organization  shall  establish  plans 
to  carry  out  its  responsibilities. 

O 

1 . 

The  planning  process  shall  include  the  following: 

a.  Establishment  of  goals  and  objectives. 

b.  Formulation  of  audit  plans. 

c.  Assessment  of  accomplishments. 

2. 

Long  and  short  term  goals  and  objectives  should  be 
established  for  the  internal  audit  organization.  The  goals 
and  objectives  should  be  achievable;  included  in  written 
operating  plans  and  budgets;  and  accompanied  by  measurement 
criteria  and  target  dates  for  accomplishment. 

3. 

The  internal  audit  organization  shall  prepare  an  annual  audit 
plan.  The  plan  shall  be  flexible  and  adjusted,  as  necessary, 
to  provide  for  audit  coverage  of  unforeseen  priorities.  The 
head  or  deputy  head  of  the  agency  shall  review  the  plan  upon 
completion.  At  a  minimum,  such  plans  shall  identify  the 
programs  and  operations  selected  for  audit  and  define  the 
following  for  each: 

a.  Specific  reasons  for  the  selection. 

b.  Overall  audit  objective. 

c.  Locations  to  be  audited. 

d.  Organization  that  will  perform  the  audit. 

e.  Staff  days  and  other  resources  needed  to  perform  the  audit. 

f.  Anticipated  benefits  to  be  obtained  from  the  audit. 

r 

4. 

The  internal  audit  organization  shall  assess  its  results  and 
accomplishments.  To  conduct  such  evaluations,  the  internal 
audit  organization  shall  develop  and  maintain  a  data  base  that 
includes,  a.  a  minimum  the  following:  a  history  of  past  efforts 

2-15 

DoD  7600. 7-M 


and  results  to  show  prior  performance,  a  planning  process  to 
show  expected  performance,  and  a  management  information  system 
to  show  actual  performance  and  results.  The  data  base  shall 
be  developed  in  accordance  with  the  policies  of  DoD  Directive 
5000.19,  "Policies  for  the  Management  and  Control  of  Information 
Requirements"  (reference  (g)).  The  audit  organization  should 
assess  realistically  the  information  in  the  data  base  to 
identify  shortfalls  in  performance,  improve  operations  in  the 
future,  determine  whether  goals  and  objectives  are  reasonable, 
and  affix  accountability  for  results. 

660  Coordination  -  The  internal  audit  organization  shall  coordinate 

its  activities  internally  and  with  other  components  of  Government 
to  ensure  effective  use  of  available  resources. 

1.  In  planning  work  to  be  performed,  the  internal  audit  organization 
shall  coordinate  with  agency  management  to  ensure  management 
needs  are  considered  appropriately. 

2.  The  internal  audit  organization  shall  minimize  unnecessary 
duplication  of  audit  work  by  coordinating  the  nature  and 
scope  of  their  audits  and  reviews  with  other  DoD  audit, 
investigation,  and  inspection  groups. 

3.  Audit  plans  shall  be  exchanged  among  DoD  internal  audit 
organizations.  Also,  the  internal  audit  organization  shall 
meet  with  the  appropriate  GAO  officials  to  exchange  and  discuss 
tentative  audit  plans  for  the  next  fiscal  year.  If  overlapping 
or  duplicative  coverage  is  indicated,  every  effort  shall  be 
made  to  resolve  it. 

4.  Upon  beginning  an  audit,  the  audit  staff  shall  seek  information 
concerning  other  audits  and  reviews  that  have  been  performed  of 
that  activity  or  program. 

5.  The  audit  staff  shall  be  alert  to  situations  where  problems 
are  identified  that  may  affect  other  DoD  Components  or  Federal 
agencies.  When  such  situations  arise,  the  internal  audit 
organization  shall  coordinate  with  others  involved  so  that, 
where  appropriate,  one  audit  may  be  performed  to  fulfill  the 
requirements  of  all. 

670  Internal  Audit  Organization  Qualifications  -  The  internal  audit 
organization  shall  possess  or  obtain  the  knowledge,  skills,  and 
disciplines  needed  to  carry  out  its  audit  responsibilities. 

1.  The  internal  audit  organization  shall  assess  the  skills  of 
staff  on  board,  determine  the  extent  to  which  these  skills 
match  requirements,  and  develop  a  plan  to  address  the  skills 
that  are  deficient. 
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The  audit  staff  collectively  must  possess  the  knowledge,  skill, 
discipline,  and  experience  essential  to  the  practice  of  the 
auditing  profession.  These  attributes  include  proficiency  in 
applying  auditing  standards,  procedures,  and  techniques, 

3.  The  internal  audit  organization  shall  have  employees  or  use 

outside  experts  who  are  qualified  in  the  disciplines  needed  to 
meet  audit  responsibilities.  The  disciplines  include  accounting, 
budgeting,  statistics,  computer  systems,  engineering,  medicine, 
law,  etc.  Each  member  of  the  internal  audit  organization, 
however,  need  not  be  qualified  in  all  of  these  disciplines. 

680  Personnel  Management  and  Development  -  The  internal  audit  organization 
shall  establish  a  program  for  selecting  and  developing  its  human 
resources.  The  program  shall  provide  for  the  following: 

1.  Selection  of  qualified  and  competent  individuals. 

2.  Training  and  continuing  educational  opportunities  for  each 
staff  member. 

3.  Appraisal  of  each  auditor's  performance  at  least  annually. 

4.  Retention  and  promotion  of  highly  skilled  personnel  to  senior 
management  positions. 

5.  Counseling  to  auditors  on  their  performance  and  professional 
development. 

690  Quality  Assurance  -  Each  internal  audit  organization  shall  establish 
and  maintain  a  quality  assurance  program  to  ensure  that  work 
performed  adheres  to  DoD  auditing  standards,  policies,  and  procedures; 
conforms  to  internal  regulations;  and  is  carried  out  economically, 
efficiently,  and  effectively. 

1.  A  quality  assurance  program  shall  include  the  following 
elements : 

a.  Supervision. 

b.  Internal  reviews. 

c.  External  reviews. 

2.  Supervision  of  the  work  of  auditors  shall  be  carried  out 
continually  to  ensure  conformance  with  auditing  standards, 
organization  policies  and  procedures,  and  audit  programs. 

Internal  reviews  shall  be  performed  periodically  by  members 
of  the  audit  staff  to  appraise  the  quality  of  the  audit  work 
performed.  These  reviews  shall  be  performed  in  the  same 
manner  as  any  other  internal  audit. 


3. 


External  reviews  shall  be  performed  to  appraise  the  quality  of 
the  internal  audit  organization's  operations.  These  reviews 
shall  be  performed  using  guidelines  published  by  the  Office 
of  the  Inspector  General,  Department  of  Defense.  Such  reviews 
shall  be  conducted  at  least  once  every  3  years.  Unless  other¬ 
wise  directed,  the  Office  of  the  Assistant  Inspector  General 
for  Audit  Policy  and  Oversight  shall  conduct  the  reviews  of 
the  DoD  central  internal  audit  agencies  and  they,  in  turn, 
shall  conduct  reviews  of  their  component's  internal  review  or 
military  exchange  audit  organizations.  On  completion  of  the 
review,  a  formal  written  report  shall  be  issued.  The  report 
shall  express  an  opinion  as  to  the  organization's  compliance 
with  the  DoD  auditing  standards  and,  as  appropriate,  shall 
include  recommendations  for  improvement. 
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•  .  CHAPTER  6 

COORDINATING  AUDIT  ACTIVITIES 

A.  PURPOSE 


This  chapter  prescribes  policy  and  suggests  procedures  for  coordinating 
audit  activities  and  exchanging  audit  results. 

B.  APPLICABILITY 

1.  The  standards  and  policies  prescribed  in  sections  C  and  D  which  follow 
are  mandatory  for  all  DoD  internal  audit,  internal  review  and  military  exchange 
audit  activities  (hereafter  referred  to  collectively  as  "DoD  internal  audit 
organizations").  The  provisions  of  sections  E  through  L  are  not  mandatory 
steps,  but  are  suggested  guidelines  for  accomplishing  coordination  policies. 
Certain  procedures  described  in  this  chapter  may  not  be  applicable  to  every 
audit  organization,  but  the  principles  and  objectives  remain  mandatory.  The 
word  "should"  is  used  to  denote  the  desirability  of  an  action.  If  followed, 
the  procedures  will  implement  satisfactorily  the  policies  and  standards  which 
apply.  The  DoD  internal  audit  organizations  will  be  measured  on  their 
performance  in  relation  to  internal  audit  standards  and  policies. 

2.  Since  the  provisions  of  this  manual  are  applicable  only  to  the  DoD 
internal  audit  organizations,  other  policies  requiring  wider  cooperation 
between  all  the  DoD  audit,  inspection  and  investigative  elements  will  be 
published  in  a  forthcoming  DoD  Directive. 

C.  DOD  INTERNAL  AUDITING  STANDARDS 


The  DoD  internal  auditing  standards  concerning  coordination  are  as 
follows : 


660  Coordination  -  The  internal  audit  organization  shall  coordinate 

its  activities  internally  and  with  other  components  of  government 
to  ensure  effective  use  of  available  resources. 

1.  In  planning  work  to  be  performed,  the  internal  audit 
organization  shall  coordinate  with  agency  management  to 
ensure  management  needs  are  considered  appropriately. 

2.  The  internal  audit  organization  shall  minimize  unnecessary 
duplication  of  audit  work  by  coordinating  the  nature  and  scope 
of  their  audits  and  reviews  with  other  DoD  audit,  investigation, 
and  inspection  groups. 

3.  Audit  plans  shall  be  exchanged  among  DoD  internal  audit 
organizations.  Also,  the  internal  audit  organization  shall  meet 
with  the  appropriate  GAO  officials  to  exchange  and  discuss 
tentative  audit  plans  for  the  next  fiscal  year.  If  overlapping 
or  duplicative  coverage  is  indicated,  every  effort  shall  be 
made  to  resolve  it. 


.  •  .  '  .  ■r. 


6-1 


•-  ■ 


- 


DoD  7600. 7-M 


4.  Upon  beginning  an  audit,  the  audit  staff  shall  seek 
information  concerning  other  audits  and  reviews  that  have 
been  performed  of  that  activity  or  program. 

5.  The  audit  staff  shall  be  alert  to  problem  situations  that  may 
affect  other  DoD  Components  or  Federal  agencies.  When  such 
situations  arise,  the  internal  audit  organization  shall 
coordinate  with  others  involved  so  that,  when  appropriate,  one 
audit  may  be  performed  to  fulfill  the  requirements  of  all. 

D.  POLICY 

1.  The  Inspector  General  Act  of  1978,  as  amended  (reference  (a)),  directs 
the  IG,  DoD  to  give  particular  regard  to  the  activities  of  the  internal  audit, 
inspection,  and  investigative  units  of  the  Military  Departments  with  a  view 
toward  avoiding  duplication  and  ensuring  effective  coordination  and 
cooperation. 

2.  Office  of  Management  and  Budget  Circular  A-73  (reference  (b))  contains 
the  principle  that  "...audit  effectiveness  is  enhanced  by  audit  coordination." 
Under  the  provisions  of  reference  (b).  Federal  audit  organizations  are  required 
to  coordinate  and  cooperate  with  each  other  in  developing  and  carrying  out 
their  respective  audit  plans.  Effective  coordination  requires  continuous 
liaison;  the  exchange,  when  appropriate,  of  audit  techniques,  objectives, 
plans,  working  papers,  and  audit  results;  and  the  development  of  audit 
schedules  to  minimize  the  amount  of  audit  effort  required. 

3.  The  provisions  of  reference  (b)  have  been  implemented  in  DoD  Directive 
7600.2  (reference  (h)).  The  DoD  internal  audit  organizations  shall  coordinate 
and  cooperate  with  each  other  and  with  other  DoD  audit,  investigative, 
inspection,  and  management  review  groups  to  ensure  effective  use  of  audit 
resources,  preclude  unnecessary  duplication  or  overlap  of  review  efforts,  and 
permit  efficient  oversight  of  DoD  programs  and  operations.  The  DoD  internal 
audit  organizations  also  shall  coordinate  and  cooperate  with  the  GAO  and 
non-Federal  audit  organizations  where  there  is  a  common  interest  in  the 
programs  subject  to  audit. 

4.  Coordination  shall  be  a  continuing  effort  and  not  merely  an  after- 
the-fact  reaction  to  a  potential  scheduling  problem.  The  degree  of  formal 
coordination  depends,  in  part,  on  the  relative  size  of  the  audit  organization 
and  its  placement  within  a  DoD  Component.  Although  coordination  is  most 
important  for  large  scale,  multilocation  audits  because  of  the  significant 
amount  of  planning,  resources,  and  time  they  require,  coordination  of  all 
review  efforts  shall  be  the  general  rule  rather  than  the  exception. 

5.  Coordination  shall  begin  as  early  in  the  audit  planning  process  as 
practical  because  coordination,  especially  during  the  audit  planning  phase, 
can  save  valuable  time  and  effort.  Coordination  includes  sharing  technical 
information  about  audit  approaches  and  techniques,  exchanging  audit  results, 
and  cooperating  in  joint  training  efforts. 

6.  When  overlapping  or  duplicative  coverage  is  indicated,  the  DoD 
internal  audit  organizations  shall  try  to  resolve  conflicts. 
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E.  RESPONSIBILITIES 

1.  Every  organizational  level  within  the  DoD  internal  audit  organizations 
should  coordinate  review  efforts  and  exchange  information.  Specifically, 
coordination  and  cooperation  should  be  exercised  between  the  following; 

a.  The  DoD  internal  audit  activities  and  the  GAO.  The  GAO  frequently 
uses  published  audit  reports  during  surveys  to  either  direct  their  efforts  to 
areas  not  previously  covered  by  DoD  audit  organizations,  or  to  rely  on 
published  findings  instead  of  performing  review  work  of  their  own. 

b.  The  Military  Department  audit  agencies  and  the  Office  of  the 
Assistant  Inspector  General  for  Auditing  (OAIG-AUD),  OIG,  DoD.  Coordination  in 
the  early  planning  stages  of  each  audit  is  especially  important  since  both 
activities  conduct  audits  within  the  same  DoD  Component. 

c.  The  Military  Department  audit  agencies  concerned  and  other  Military 
Department  audit  agencies.  Coordination  is  important  because  audits  in  one 
Military  Service  may  disclose  conditions  that  could  be  affecting  operations 
adversely  in  other  Components. 

d.  The  Military  Department  audit  agencies  and  the  internal  review 
elements  within  their  respective  DoD  Component.  Internal  review  activities 
often  provide  an  audit  liaison  service  for  their  organizations,  in  addition  to 
their  principal  mission  of  serving  commanding  officers  in  ensuring  sound 
management  practices  and  procedures  are  observed  within  their  organization. 
Consequently,  this  level  of  coordination  is  essential  to  effective  audit  work 
by  the  various  internal  and  external  audit  staffs. 

e.  The  Military  Department  audit  agencies  and  the  Military  Department 
inspector  general  organizations.  With  the  increasing  use  of  systemic 
inspection  techniques,  the  headquarters  levels  of  Military  Department  inspector 
general  organizations  are  undertaking  broader,  more  indepth  reviews  similar  to 
the  multilocation  audits  of  the  internal  audit  activities. 

f.  The  Military  Department  audit  agencies  and  the  Military  Department 
criminal  investigative  agencies.  Starting  or  continuing  an  audit  in  an  area 
where  there  may  be  an  ongoing  investigation  is  a  matter  for  careful  consider¬ 
ation  . 


g.  The  OAIG-AUD,  OIG,  DoD,  and  the  Offices  of  the  Assistant 
Inspectors  General  for  Inspections,  Investigations,  and  Audit  Followup. 

h.  Resident  auditors,  inspectors,  internal  reviewers,  and  investigators 
at  major  command  levels,  as  well  as  those  at  installation  level.  Although 
procedures  for  coordinating  in  areas  of  mutual  interest  may  be  less  formal  than 
coordination  procedures  used  at  the  central  headquarters  of  the  major  review 
activities,  cooperation  and  effective  working  relationships  are  equally 
important  at  local  levels. 
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i.  The  DoD  iaternal  audit  organizations  and  the  Defense  Contract 
Audit  Agency  (DCAA) .  When  performing  reviews  of  the  procurement  function, 
internal  audit  organizations  may  require  the  assistance  of  DCAA  to  evaluate 
contracting  and  contract  administration  activities. 

2.  Coordination  extends  beyond  merely  exchanging  audit  schedules  with 
other  review  groups  and  providing  audit  reports  upon  request.  Coordination 
also  involves  establishing  close  liaison  and  good  working  relationships  with 
other  DoD  review  groups,  external  review  groups,  and  DoD  managers.  To  promote 
the  most  efficient  use  of  resources  among  the  members  of  the  inspector  general 
community  and  to  ensure  that  the  efforts  of  each  review  group  complement  rather 
than  duplicate  each  other,  each  DoD  internal  audit  organization  should 
establish  programs  to  accomplish  the  following; 

a.  Meet  with  counterparts  on  a  regularly  scheduled  basis. 

b.  Exchange  audit  plans  and  schedules. 

c.  Exchange  information  on  technical  matters,  including  audit 

programs . 

d.  Obtain  input  on  suggested  areas  for  audit. 

e.  Ensure  management's  needs  are  considered  in  establishing  audit 
priorities . 

f.  Suggest  areas  for  inspection  or  investigation. 

g.  Provide  access  to  internal  audit  and,  with  command  approval, 
internal  review  reports. 

h.  Distribute  copies  of  audit  announcements,  when  applicable. 

i.  Exchange  information  on  prior  audit  coverage  and  review  results. 

j.  Request  audit  assistance  from  other  review  groups,  as  necessary. 

k.  Be  alert  to  problems  that  may  affect  other  agencies  and,  when 
such  situations  arise,  coordinate  with  others  involved  to  see  if  a  single 
review  can  satisfy  all  requirements. 

F.  RESOLUTION  OF  POTENTIAL  CONFLICTS 

1.  The  DoD  internal  audit  organizations  should  establish  formal 
procedures  to  accomplish  the  following: 

a.  Identify  the  review  efforts  of  other  DoD  and  Federal  review 

groups . 

b.  Ascertain  whether  the  possibility  of  a  scheduling  conflict  or 
duplication  of  effort  exists. 

c.  Resolve  any  issues  raised  during  the  coordination  process. 
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d.  Respond,  in  a  positive  manner,  to  the  coordination  efforts  of 
other  review  groups.  As  an  example,  when  a  DoD  internal  audit  activity 
receives  a  schedule  or  specific  announcement  of  a  review  from  another  review 
group  (for  example,  GAO,  OAIG-AUD,  Inspection,  etc.),  they  should  send  the 
document  to  the  appropriate  offices  within  their  organization.  The  offices 
should  be  required  to  review  the  information  and  report  back  to  a  central  point 
(possibly  the  planning  office)  that  either  (1)  no  potential  duplication  exists, 
or  (2)  if  a  problem  was  noted,  action  was  taken  to  resolve  the  problem. 

NOTE:  Close,  effective  liaison  with  other  review  groups  will  help  audit 
organizations  identify  potential  scheduling  conflicts  and  indications  of 
duplicative  audit  work. 

2.  The  DoD  internal  audit  organizations  should  resolve  problems  promptly 
when  coordination  indicates  the  following: 

a.  Potential  conflict  exists  with  respect  to  a  scheduled  or  ongoing 
audit  review. 

b.  The  scheduling  of  an  audit  may  be  inappropriate  or  untimely. 

c.  The  results  of  a  previous  review  could  be  used  to  satisfy  the 
audit  requirement  or  reduce  the  scope  of  an  audit. 

NOTE:  Resolution  may  include  (1)  agreeing  to  meet  and  coordinate  the  review 
efforts,  etc;  (2)  rescheduling  the  review  of  either  organization  by  mutual 
consent;  (3)  providing  audit  information  to  the  other  party  that  could  reduce 
or  modify  the  scope  of  audit  coverage;  (4)  documenting  the  need  for  overlapping 
audit  effort;  or  (5)  elevating  the  problem  to  a  higher  level  when  agreement 
cannot  be  reached. 

3.  The  nature  of  coordination  between  internal  review  and  military 
exchange  audit  activities  to  identify  and  resolve  conflicts  may  vary  with 
the  size  of  the  organization  and  with  the  degree  of  centralization  or 
decentralization  of  operations.  However,  smaller  audit  organizations  are 
still  responsible  for  avoiding  duplication  and  for  notifying  other  groups 
when  their  reviews  may  duplicate  or  overlap  other  reviews.  Internal  review 
activities  that  provide  liaison  with  auditors  or  other  reviewers  are  uniquely 
positioned  to  identify  conflicting  efforts  and  to  help  promote  coordination. 

G.  COORDINATION  PROCEDURES  AND  PRACTICES 

1.  During  the  coordination  process,  the  following  information  on  audit 
subjects  normally  should  be  provided  in  sufficient  detail  to  clearly  identify 
the  area  to  be  audited: 

•  a.  Title  of  the  audit  review  and  the  project  number. 

b.  Purpose  and  objectives. 

c.  Scope  of  the  review. 

d.  Timing  of  the  review. 

e.  Locations,  organizations,  and  programs  to  be  reviewed. 

f.  Contact  point  for  further  information. 
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2.  On  small  audits  it  may  not  be  feasible  to  coordinate  routinely 
descriptive  information,  but  the  DoD  audit  organizations  should  make  these  data 
available  upon  request.  In  some  instances,  it  may  not  be  possible  or  practical 
to  identify  the  specific  audit  locations  and  timing  during  the  initial  coordin¬ 
ation  process;  however,  this  information  should  be  identified  and  coordinated 
before  beginning  the  audit  application  (verification)  phase.  When  an  audit  is 
canceled  or  an  audit  survey  indicates  further  audit  work  would  be  unproductive, 
the  DoD  audit  organizations  should  notify  management  in  a  timely  manner.  Other 
participants  in  the  original  coordination  process  may  be  notified  through 
publication  of  a  revised  audit  schedule  periodically. 

3.  When  overlapping  audit  and  inspection  efforts  are  identified  during 
the  initial  coordination  process,  and  all  organizations  involved  continue  their 
review  efforts,  the  DoD  audit  organizations  should  arrange  to  exchange 
information  on  the  results  of  the  review  with  the  other  review  organizations 
before  releasing  the  report.  This  will  ensure  that  differences  in  scope  and 
objectives  are  clearly  reported. 


4.  The  DoD  audit  organization  should  establish  procedures  for  referring 
problems  more  effectively  handled  by  Military  Department  inspector  general 
activities  to  the  appropriate  inspection  organization.  Certain  problems,  by 
their  nature,  are  handled  more  appropriately  by  inspectors,  while  others  are 
addressed  more  appropriately  by  auditors.  Therefore,  the  exchange  of  inform¬ 
ation  and  recommendations  about  audits  and  inspections  is  mutually  beneficial 
for  both  types  of  organizations  and  their  respective  Components. 

5.  The  Military  Department  audit  organizations  should  establish 
procedures  for  referring  audit  suggestions  to  the  OAIG-AUD,  OIG,  DoD,  if  the 
audit  subject  applies  to  more  than  one  DoD  Component  and  car.  be  addressed  more 
appropriately  by  a  DoD-wide  audit.  Conversely,  the  OAIG-AUD  should  establish 
procedures  for  referring  audit  suggestions  to  the  appropriate  Military 
Department  audit  organization  when  an  audit  problem  has  limited  DoD-wide 
applicability. 

H.  RELATIONSHIPS  WITH  MANAGEMENT 

1.  Before  beginning  an  audit,  the  DoD  audit  organizations  should  furnish 
the  audit  scope  and  objectives  to  appropriate  managers  in  the  activity  under 
audit.  Auditors  should  provide  sufficient  advance  notice  of  the  audit  and 
observe  the  established  chain  of  command  during  the  coordination  process. 


i. 


.-mi 


2.  Managers  at  local  installations  and  intermediate  command  levels 
frequently  conduct  studies  and  analyses  of  internal  operations.  During  the 
initial  coordination  process,  auditors  should  determine  whether  any  studies  or 
analyses  are  planned  by  management  in  the  proposed  audit  area,  and  review  these 
plans  and  any  studies  that  may  have  been  completed  recently.  If  unable  to 
review  management  studies  before  beginning  the  audit,  the  auditor  should 
contact  management  or  the  audit  liaison  office  to  obtain  the  studies  upon 
arrival  at  the  audit  site.  To  the  extent  possible,  the  DoD  audit  organizations 
should  reduce  the  scope  of  audit  efforts  based  on  the  objectives,  extent,  and 
quality  of  the  management  review. 
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3.  Internal  auditors  should  make  every  effort  to  follow  procedures  pre¬ 
scribed  by  the  activity  under  audit  to  coordinate  the  audit,  to  ensure  the 
auditors'  needs  for  information  are  communicated  to  responsible  officials, 
and  to  ensure  management's  views  are  obtained  as  the  audit  progresses.  When 
auditors  need  to  contact  operating  personnel  directly  to  expedite  a  review, 
auditors  should  notify  appropriate  management  officials  and  explain  the 
purpose  and  importance  of  the  contact. 

I.  INTERNAL  AUDIT  RELATIONSHIPS  WITH  DCAA 


The  DoD  internal  audit  organizations  should  coordinate  all  reviews 
involving  contractor  records  with  DCAA  and  with  the  appropriate  contract 
administration  office  to  avoid  duplication  of  audit  work.  In  addition,  the 
DoD  audit  organizations  should  request  the  services  of  DCAA  whenever  data  must 
be  obtained  directly  from  contractors  or  from  working  paper  files  maintained 
by  DCAA.  Requests  should  be  in  sufficient  detail  to  avoid  misunderstandings 
as  to  the  objectives  being  pursued.  Internal  auditors  may  discuss  requests 
with  the  local  DCAA  auditors  hut  discussions  should  be  confirmed  subsequently 
in  writing.  (More  specific  guidance  on  this  subject  is  contained  in  Contract 
Audit  Policy  Memorandum  No.  1,  reference  (i)). 

J.  LIAISON  WITH  OTHER  REVIEW  GROUPS 

1.  The  DoD  internal  audit  organizations  should  recognize  the  complementary 

nature  of  the  various  types  of  review  efforts  and  establish  procedures  for 
identifying  review  efforts  completed,  in  process,  or  planned  by  other  audit, 
investigative,  and  inspection  review  groups.  Each  auditor  should  determine  the 
extent  of  work  done  by  other  review  groups  when  planning  audits.  If  the 

analysis  of  other  work  in  the  area  indicates  duplication  or  overlap,  internal 

auditors  should  reduce  the  scope  of  the  planned  audit,  cancel  or  postpone  the 

audit,  or  build  on  the  work  already  done  in  the  area,  as  appropriate. 

2.  To  determine  the  scope  of  work  covered  by  another  review  effort, 
internal  auditors  may  need  to  review  audit  working  papers  from  another  agency. 

The  DoD  internal  audit  organizations  should  provide  access  to  other  DoD  internal 
audit  organizations  in  the  interest  of  avoiding  duplication. 

♦ 

3.  Whenever  possible,  auditors  should  meet  with  inspector  general 
personnel  to  discuss  their  inspections  of  the  area,  obtain  suggestions  for  the 
audit,  and  review  inspection  reports.  If  the  audit  is  in  an  area  that  may  be 
particularly  conducive  to  fraud  or  serious  abuse,  or  where  a  prior  investigation 
may  have  been  conducted,  auditors  should  contact  the  local  criminal  investigative 
element  to  coordinate  their  work. 

K.  SHARING  TECHNIQUES  AND  PROGRAMS 


To  optimize  the  use  of  resources,  the  DoD  internal  audit  organizations 
should  take  advantage  of  audit  techniques  developed  by  others.  Sharing  audit 
techniques  includes  making  maximum  use  of  existing  audit  programs  and  guides 
to  reduce  the  time  and  effort  required  to  develop  new  programs  for  individual 
audit  projects.  To  help  audit  organizations  share  audit  programs,  the  OIG, 

DoD,  publishes  a  Directory  of  Internal  Audit  Programs  annually.  The  directory 
provides  information  on  audit  programs  by  organization  and  functional  area,  and 
provides  directions  for  obtaining  the  programs.  When  researching  and  planning 
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an  audit,  DoD  auditors  should  obtain  copies  of  audit  programs  and  guides 
covering  the  audit  area  and  consider  using  them  to  develop  the  detailed  audit 
plan.  The  DoD  internal  audit  organizations  also  are  strongly  encouraged  to 
interchange  ideas  related  to  the  use  of  computers  or  other  advanced  techniques 
for  audit. 

L.  TRAINING  COOPERATION 


Audit  training  also  should  be  coordinated.  The  DoD  internal  audit 
organizations  should  determine  the  availability  of  training  from  other  audit 
organizations  and,  if  possible,  make  arrangements  to  have  their  staff  attend 
training  courses  sponsored  by  other  audit  agencies.  Sharing  training  promotes 
consistency  in  audits,  fosters  closer  working  relationships  among  audit 
organizations,  and  keeps  auditors  informed  of  developments  in  other  audit 
organizations.  Policies  and  guidelines  relating  to  auditor  training  are 
covered  in  Chapter  4  of  this  manual. 
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CHAPTER  10 

AUDIT  REQUIREMENTS  GENERATED  BY  SOURCES  EXTERNAL  TO 
DEPARTMENT  OF  DEFENSE 
PART  I 

INTRODUCTION 


Many  external  forces  impact  on  the  roles  and  responsibilities  of  internal 
audit  and  internal  review  organizations  within  the  Department  of  Defense. 

These  include  actions  by  the  Congress,  the  Office  of  Management  and  Budget 
(0MB),  the  Comptroller  General  of  the  United  States,  and  organizations  within 
the  professional  audit  community.  This  chapter  provides  policy  and  guidance 
on  how  to  meet  requirements  imposed  by  external  organizations.  The  various 
parts  of  this  chapter  describe  specific  requirements  established  by  the  IG, 

DoD  to  comply  with  legislative  acts,  0MB  circulars,  and  other  such  authorities 

As  specific  requirements  arise  requiring  implementing  audit  policies, 
these  audit  policies  will  be  added  to  this  chapter. 
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PART  II 

INTERNAL  CONTROL  SYSTEMS 


A.  PURPOSE 


Part  II  establishes  policy  for  evaluating  and  reporting  on  DoD  internal 
control  systems  under  the  Federal  Managers'  Financial  Integrity  Act  of  1982 
(reference  (j),  0MB  Circular  No.  A- 123  (reference  (k)),  and  DoD  Directive 
5010.38  (reference  (1)). 

B.  APPLICABILITY 

All  DoD  internal  audit  organizations  including  internal  review  and 
military  exchange  audit  activities  shall  comply  with  applicable  policy 
provisions  in  Part  II. 

C.  DEFINITIONS 

1.  Internal  Control  Review.  A  detailed  examination  of  a  system  of 
internal  control  to  determine  whether  adequate  controls  are  used  to  prevent 
or  detect  potential  risks. 

2.  Internal  Control  Standards.  Standards  issued  by  the  Comptroller 
General  in  June  1983  to  help  managers  in  all  executive  agencies  establish  and 
maintain  effective  systems  of  internal  control,  as  required  by  the  Integrity 
Act  (reference  (j)). 

3.  Internal  Control  System.  The  sum  of  an  organization's  plans,  methods, 
and  measures  used  to  achieve  the  objectives  of  internal  or  management  control 
described  in  subsection  C.A.  below.  The  internal  control  system  encompasses 
both  administrative  and  accounting  type  controls. 

4.  Internal  (Management)  Control.  The  plan  of  organization,  methods, 
and  measures  adopted  by  management  within  the  Department  of  Defense  to  (a) 
ensure  compliance  with  applicable  laws,  regulations,  and  policies;  (b) 
safeguard  resources  against  waste,  loss,  unauthorized  use,  or  misappropriation; 
and  (c)  ensure  the  reliability  and  accuracy  of  financial  records,  statistical 
records,  and  reports.  Internal  control  includes  administrative  control  and 
accounting  control.  Generally,  administrative  controls  focus  on  program 
performance  and  the  efficiency  and  effectiveness  of  operations.  Accounting 
controls  normally  focus  on  traditional  financial  management  areas.  Internal 
control  is  referred  to  in  DoD  Directive  5010.38  (reference  (1))  as  "internal 
management  control,"  but  according  to  0MB,  the  terms  "internal  control"  and 
"management  control"  are  synonymous.  Internal  or  management  controls  should 

be  an  integral  part  of  each  system  (such  as  administrative,  operations,  and 
accounting)  that  management  uses  to  achieve  '.he  objectives  of  agency  programs, 
functions,  and  activities. 

5.  Material  Weakness.  A  situation  in  which  the  designated  procedures, 
or  the  degree  of  compliance  with  the  designated  procedures,  do  not  provide 
reasonable  assurance  that  the  objectives  of  internal  control  enumerated  in 
subsection  C.4.  above,  are  being  achieved.  See  Appendix  A  for  further 
information  on  material  weaknesses. 
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6.  0MB  Guidelines.  Guidelines  issued  by  0MB  in  December  1982  in  response 
to  requirements  in  the  Integrity  Act  (reference  (j)).  The  0MB  Guidelines 
(reference  (m) )  can  help  DoD  managers  to  (a)  develop  specific  plans  for 
self-evaluations  of  internal  control  systems,  (b)  improve  existing  control 
systems,  and  (c)  comply  with  the  internal  control  reporting  requirements 
imposed  by  reference  (j). 

7.  Vulnerability  Assessment.  A  review  of  the  susceptibility  of  a 
program  or  function  to  waste,  loss,  unauthorized  use,  or  misappropriation. 

D.  POLICY 

1.  Internal  Audit  Activities.  The  DoD  internal  audit  activities  normally 
shall  evaluate  internal  controls  in  each  area  or  function  audited.  On  each 
scheduled  audit,  the  audit  activity  also  shall  further  evaluate  management's 
implementation  of  the  internal  control  program  as  it  relates  to  the  scope  of 
the  scheduled  audit.  Annually,  each  internal  audit  activity  shall  advise  the 
Military  Department,  agency  or  activity  whether  the  annual  internal  control 
evaluation  performed  by  management  complied  with  the  0MB  Guidelines  (reference 
(m)).  Each  internal  audit  activity  shall  send  a  copy  of  the  auditor's  annual 
statement  to  the  IG,  DoD,  by  November  15  of  each  year.  Internal  audit  activities 
are  further  encouraged  to  perform  evaluations  of  internal  control  systems 
requested  by  their  respective  Department,  agency,  or  activity  and  to  provide, 
whenever  practicable,  technical  assistance  to  further  the  overall  DoD  goal  of 
strengthening  internal  control  systems. 

2.  Internal  Review  and  Military  Exchange  Audit  Activities.  Internal 
review  and  military  exchange  audit  activities  normally  shall  review  and  evaluate 
applicable  internal  control  systems  during  every  audit.  These  activities  also 
may  help  the  commander  with  the  overall  evaluation  of  internal  controls  and 
provide  technical  assistance  to  managers  in  their  efforts  to  evaluate  and 
improve  internal  controls.  However,  they  shall  not  engage  in  activities  that 
could  impair  their  ability  to  assess  independently  the  adequacy  of  management's 
internal  control  systems  evaluations. 

3.  Training.  All  DoD  internal  audit  organizations  shall  provide  their 
staffs  with  adequate  training  on  the  evaluation  of  internal  control  systems, 
regulatory  requirements  governing  internal  control  systems,  and  related  roles 
and  responsibilities  of  management  and  auditors. 

E.  BACKGROUND 

1 .  The  Federal  Managers'  Financial  Integrity  Act  of  1982  (reference  (j)). 
Reference  (j)  requires  renewed  focus  on  management's  need  to  strengthen 
internal  controls  and  directs  the  Secretary  of  Defense  to  do  the  following: 

a.  Establish  a  program  for  continuous  evaluations  of  DoD  systems  of 
internal  control. 


b.  Use  0MB  Guidelines  (reference  (m))  to  evaluate  these  DoD  systems 
of  internal  control. 
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c.  Provide  an  annual  report  to  the  President  and  the  Congress  stating 
whether  the  DoD  systems  of  internal  control  comply  with  the  Integrity  Act 
(reference  (j))  and  with  the  standards  prescribed  by  the  Comptroller  General 
(reference  (n)).  If  the  controls  do  not  comply  fully,  the  report  shall  identify 
material  weaknesses  in  the  controls  and  specify  plans  for  correcting  the  weak¬ 
nesses  . 

2.  0MB  Circular  No.  A-123  (reference  (k)).  Reference  (k)  prescribes 
policy  and  standards  for  establishing,  maintaining,  evaluating,  improving, 
and  reporting  on  internal  controls.  In  addition,  reference  (k)  encourages 
the  statutory  inspectors  general  to  assume  certain  responsibilities.  These 
responsibilities  include  (a)  providing  technical  assistance  to  help  agencies 
evaluate  and  improve  internal  controls;  (b)  conducting  reviews,  either  self- 
initiated  or  requested  by  management,  of  internal  control  documentation  and 
systems;  and  (c)  advising  agency  heads,  upon  request,  whether  the  agency's 
process  for  evaluating  internal  controls  complies  with  0MB  Guidelines 
(reference  (m)).  The  IG,  DoD  has  adopted  these  responsibilities  for  the  DoD 
internal  audit  organizations.  DoD  Directive  5010.38  (reference  (1)), 
implements  reference  (k) . 

F.  AUDIT  COVERAGE  AND  ASSISTANCE 

1.  Efforts  on  Audit  Coverage  and  Assistance.  For  discussion  purposes, 
these  audit  efforts  have  been  divided  into  four  general  areas:  (a)  regularly 
scheduled  audits,  (b)  requested  audits,  (c)  technical  assistance,  and  (d) 
reviews  of  the  adequacy  of  management's  internal  control  evaluation, 
improvement,  and  reporting  process.  Each  area  is  discussed  in  the  subsequent 
paragraphs . 

2.  Regularly  Scheduled  Audits.  Internal  auditors  shall,  except  in 
unusual  circumstances,  evaluate  and  report  on  internal  controls  during  every 
audit,  whether  economy  and  efficiency  or  program  results  audits  or  financial 
and  compliance  audits  (DoD  Auditing  Standard  450). 

a.  Evaluating  Internal  Control.  The  focus  of  the  auditor's  review 
of  internal  controls  may  vary  with  the  type  of  audit.  However,  the  basic 
purpose  for  evaluating  internal  controls  during  audits  is  always  the  same, 
namely,  to  determine  the  extent  the  auditor  can  rely  on  existing  controls  when 
planning  the  nature,  extent,  and  timing  of  audit  tests  to  be  applied  during  the 
examination  and  verification  phases  of  the  audit.  The  review  of  the  system  of 
internal  controls  by  the  auditors  can  aid  in  devising  better  auditing 
procedures  for  evaluating  the  results  of  operations,  or  when  appropriate,  for 
formulating  an  opinion  on  the  fairness  of  financial  statements. 

(1)  Program  Results  and  Economy  and  Efficiency  Audits.  Within 
the  Department  of  Defense,  economy  and  efficiency  audits  normally  are  performed 
as  part  of  program  results  reviews.  During  these  reviews,  auditors  shall  eva¬ 
luate  the  internal  control  system  used  by  the  organization,  program,  activity, 
or  function  under  audit.  Because  controls  encountered  during  program  results 
and  economy  and  efficiency  audits  generally  will  be  administrative  controls, 
the  review  shall  focus  on  the  policies,  procedures,  practices,  and  controls 
used  by  management  to  achieve  program  goals  and  objectives  in  the  most 
economical  manner. 
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(2)  Financial  and  Compliance  Audits.  Except  in  unusual  circum¬ 
stances,  auditors  shall  evaluate  existing  internal  controls  during  all  financial 
and  compliance  audits.  These  internal  controls  primarily  will  be  accounting 
controls,  that  is,  the  plan  of  organization  and  the  procedures  and  records 

used  to  safeguard  assets  and  to  make  sure  financial  records  are  reliable. 
Auditors  should  be  alert  always  to  situations  or  transactions  that  indicate 
fraud,  abuse,  and  illegal  expenditures  or  acts. 

(3)  Auditing  Computer-Based  Systems 

(a)  When  auditing  computer-based  systems,  the  auditor 
shall  review  both  general  controls  in  the  data  processing  system  and 
application  controls  of  the  installed  data  applications.  These  reviews  shall 
comply  with  DoD  Auditing  Standard  460  and  follow  guidance  outlined  in  Chapter 
9,  "Auditing  Computer-Based  Systems." 

(b)  Auditors  shall  determine  whether  all  built-in 
controls  are  documented  properly  and  tested  adequately  by  the  activity. 

b.  Evaluating  Implementation  of  Internal  Control  Program.  As  part 
of  or  in  addition  to  evaluating  internal  controls  described  in  paragraph  F.2.a. 
above,  each  DoD  internal  audit  activity  will  evaluate  how  well  management  has 
implemented  the  internal  control  program  requirements  of  0MB  Circular  No.  A- 123 
(reference  (k))  and  DoD  Directive  5010.38  (reference  (1))  as  it  relates  specifi¬ 
cally  to  the  scope  of  the  scheduled  audit.  This  would  include  reviewing 
especially  the  adequacy  of  the  vulnerability  assessments  and  internal  control 
reviews  in  those  areas  in  which  the  auditors  identify  internal  control  weak¬ 
nesses  . 


c.  Reporting  Internal  Controls 

(1)  Each  audit  report,  whether  as  a  result  of  program  results, 
economy  and  efficiency,  financial  and  compliance,  or  computer-based  systems 
audit,  shall  describe  the  auditor's  evaluation  of  applicable  internal  controls 
and  shall  summarize  the  audit  results.  For  financial  and  compliance  audits, 
this  statement  on  internal  accounting  controls  shall  also  identify  the  entity's 
significant  internal  accounting  controls;  controls  identified  that  were 
evaluated;  and  controls  identified  but  not  evaluated.  If  internal  controls  are 
not  evaluated,  the  audit  report  shall  explain  why  the  controls  were  not 
evaluated.  Any  material  weaknesses  identified  in  internal  controls  shall  be 
included  and  identified  specifically  in  the  audit  report  and  also  brought  to 
the  attention  of  the  senior  management  official  responsible  for  the  activity's 
internal  control  program. 

(2)  Each  audit  report  also  shall  summarize  the  audit  results 
on  how  well  management  had  implemented  the  internal  control  program  as  it 
related  -to  the  scope  of  the  scheduled  audit. 
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3.  Requested  Audits 

a.  Occasionally,  managers  may  ask  audit  organizations  to  review 
aspects  of  their  internal  control  systems .  These  reviews  may  be  made 
separately  or  performed  in  conjunction  with  regularly  scheduled  audits. 

Based  on  the  request,  the  audit  activity  shall  establish  specific  audit 
objectives  to  guide  the  audit  effort  and  to  address  the  specific  concerns 
of  management. 

b.  When  audit  activities  agree  to  conduct  internal  control  reviews, 
the  Military  Department,  agency,  or  activity  heads  may  rely  on  the  audit 
results  in  preparing  their  annual  statements  to  the  Secretary  of  Defense. 
However,  the  Military  Department,  agency,  or  activity  heads  still  are 
responsible  for  the  overall  judgments  made  in  the  annual  statements. 

4.  Technical  Assistance 

a.  Although  the  DoD  internal  audit  activities  perform  audits  and 
reviews  as  discussed  in  subsections  F.2.  and  F.3.,  above,  and  F.5.,  below, 
they  are  not  precluded  from  providing  technical  assistance  to  managers  in 
their  efforts  to  evaluate  and  improve  internal  controls.  In  fact,  audit 
activities  are  encouraged  to  provide  technical  assistance  to  further  the 
overall  DoD  goal  of  strengthening  internal  control  systems . 

b.  However,  since  management  has  primary  responsibility  for  main¬ 
taining  a  strong  system  of  internal  control,  managers  throughout  the  DoD 
Components  shall  be  heavily  involved  in  internal  control  programs.  Therefore, 
auditors  shall  exercise  due  care  to  avoid  compromise  of  professional  indepen¬ 
dence.  Independence  shall  be  maintained  so  audit  opinions,  conclusions,  judg¬ 
ments,  and  recommendations  are  impartial,  and  will  be  viewed  as  impartial  by 
knowledgeable  third  parties. 


5. 

Process 


Review  of  the  Adequacy  of  Management's  Internal  Control  Evaluation 


a.  Auditors  shall  determine  whether  the  agency's  process  for  evaluat¬ 
ing  internal  controls  complies  with  0MB  Guidelines  (reference  (m)),  and  advise 
management  of  the  results  of  their  assessment.  As  part  of  this  assessment, 
the  auditors  should  rely  on  the  audit  results  obtained  under  the  guidelines 
in  subsection  E.I.,  above.  Additional  audit  work  should  be  programed  to  the 
extent  needed  to  support  the  annual  statement  required  under  subsection  D.3. 
above,  and  paragraph  F.S.b.,  below. 


b.  Based  on  the  audit  results,  each  internal  audit  activity  shall 
submit  a  statement  to  management  advising  them  of  the  adequacy  of  the  agency's 
internal  control  evaluation  process.  The  statement  shall  be  prepared  in  the 
format  shown  in  Figure  10-1.  By  November  15  of  each  year,  each  internal  audit 
activity  shall  also  send  a  copy  of  this  statement  to  the  IG,  DoD.  The  IG,  DoD, 
uses  these  reports  to  advise  the  Secretary  of  Defense  on  the  overall  adequacy 
of  the  evaluation  process  within  the  Department  of  Defense. 
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G.  INTERNAL  REVIEW  AND  MILITARY  EXCHANGE  AUDIT  ACTIVITIES 

1.  DoD  Directive  7600.2,  (reference  (h))  allows  internal  review  and 
military  exchange  audit  activities  to  help  managers  evaluate  the  adequacy  of 
vulnerability  assessments  and  internal  control  reviews.  However,  these  audit 
activities  shall  refrain  from  doing  vulnerability  assessments  or  internal  con¬ 
trol  reviews  because  they  are  management's  responsibility.  Such  involvement 
would  impair  independence  (DoD  Auditing  Standard  100)  and  could  prevent  the 
audit  activities  from  providing  objective,  independent  evaluations  to 
management . 

2.  These  audit  activities  are,  however,  encouraged  to  provide  technical 
assistance  to  help  managers  evaluate  and  improve  internal  controls,  including 
assisting  managers  in  training  their  staff. 

H.  TRAINING 

1.  The  audit  activities  shall  provide  training  for  their  auditors 
consistent  with  DoD  Auditing  Standard  200  on  professional  proficiency  and 
continuing  education.  Training  should  focus  on  regulatory  requirements, 
definitions,  and  standards  pertaining  to  internal  control  systems,  and  on 
the  related  roles  and  responsibilities  of  managers  and  auditors  with  respect 
to  internal  controls. 

2.  Internal  control  training  should,  at  a  minimum,  include  the  following: 

a.  Refresher  training  on  basic  internal  controls,  including  methods 
for  determining  whether  such  controls  exist  and  techniques  for  testing  and 
evaluating  their  effectiveness. 

b.  Basic  requirements  of  0MB  Circular  No.  A-123  (reference  (k)), 
the  Integrity  Act  (reference  (j)),  the  0MB  Guidelines  (reference  (m)),  the 
GAO  Internal  Control  Standards  (reference  (n)),  and  DoD  Directive  5010.38 
(reference  (1)). 

c.  Roles  and  responsibilities  of  auditors  and  managers  under  the 
Federal  internal  control  program. 

d.  Techniques  for  evaluating  management's  implementation  of  0MB 
Circular  No.  A-123  (reference  (k)).  Training  should  include  how  to  make 
vulnerability  assessments  and  conduct  internal  control  reviews. 

3.  Similar  training  shall  be  provided  to  the  staffs  of  internal  review 
and  military  exchange  audit  activities,  whenever  possible. 
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MEMORANDUM  FOR  (agency  or  activity  head) 

SUBJECT:  Statement  on  Internal  Control  Systems 

We  have  conducted  a  review  to  determine  whether  the  (agency  or  activity) 
has  evaluated  their  system  of  internal  accounting  and  administrative  control 
for  the  year  ended  (date)  in  a  reasonable  and  prudent  manner  and  in  accordance 


Internal  Control  Systems  in  the  Federal  Government,  issued  by  the  Director, 
0MB.  During  this  review,  nothing  came  to  my  attention  that  would  indicate 
that  the  (agency  or  activity)  did  not  comply  with  the  0MB  Guidelines.*  The 
scope  of  our  review  and  support  for  our  conclusion  are  shown  in  the  enclosure. 


(signature) 


*If  this  statement  cannot  be  made,  revise  to  highlight  majo'r 
deficiencies . 


Figure  10-1.  Format  for  Audit  Statement  to  Agency  or  Activity 

on  Adequacy  of  Management's  Internal  Control  Review 
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CHAPTER  14 

QUALITY  ASSURANCE  PROGRAMS 


A.  PURPOSE 


This  chapter  describes  the  essential  elements  of  quality  assurance 
programs,  including  applicable  professional  standards  and  responsibilities,  and 
prescribes  policy  for  establishment  of  such  programs  in  DoD  internal  audit 
organizations. 

B.  APPLICABILITY 


The  provisions  of  this  chapter  are  mandatory  for  all  DoD  internal  audit 
organizations,  including  internal  audit,  internal  review,  and  military  exchange 
audit  activities;  and  for  the  offices  that  provide  oversight  and  program 
direction  of  the  internal  review  functions  of  the  Army,  Navy,  Marine  Corps, 
and  Defense  Logistics  Agency. 

C.  QUALITY  ASSURANCE  STANDARDS 


• 


m  ...Ji 


Pertinent  excerpts  from  the  DoD  internal  auditing  standard  (Chapter  2  of 
this  manual)  follow: 

690  Quality  Assurance  -  Each  internal  audit  organization  shall 
establish  and  maintain  a  quality  assurance  program  to  ensure  that  work 
performed  adheres  to  DoD  auditing  standards,  policies,  and  procedures;  conforms 
to  internal  regulations;  and  is  carried  out  economically,  efficiently,  and 
effectively. 

1.  A  quality  assurance  program  shall  include  the  following 

elements : 

a.  Supervision 

b.  Internal  reviews 

c.  External  reviews 

2.  Supervision  of  the  work  of  auditors  shall  be  carried  out 
continually  to  ensure  conformance  with  auditing  standards,  organization 
policies  and  procedures,  and  audit  programs. 

3.  Internal  reviews  shall  be  performed  periodically  by  members  of 
the  audit  staff  to  appraise  the  quality  of  the  audit  work  performed.  These 
reviews  shall  be  performed  in  the  same  manner  as  any  other  internal  audit. 

4.  External  reviews  shall  be  performed  to  appraise  the  quality  of 
the  internal  audit  organization's  operations.  These  reviews  shall  be  performed 
using  guidelines  published  by  the  Office  of  the  Inspector  General  (OIG) ,  DoD. 
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Such  reviews  shall  be  conducted  at  least  once  every  3  years.  On  completion 
of  the  review,  a  formal  written  report  shall  be  issued.  The  report  shall 
express  an  opinion  as  to  the  organization's  compliance  with  the  DoD  auditing 
standards  and,  as  appropriate,  shall  include  recommendations  for  improvement. 

D.  POLICY 

1.  To  maintain  the  confidence  and  trust  of  DoD  management,  the  Congress, 
and  private  citizens,  DoD  auditors  shall  provide  objective,  reliable,  timely, 
and  professional  audit  products.  The  value  of  the  services  provided  by  DoD 
auditors  is  related  directly  to  the  quality  of  the  audit  work  performed.  In 
addition,  the  professionalism  of  DoD  auditors  is  critical  to  acceptance  and  use 
of  their  work  by  DoD  managers  in  improving  and  strengthening  DoD  programs  and 
operations . 

2.  Each  internal  audit  organization  shall  have  a  viable  and  effective 
quality  assurance  program  that  provides  reasonable  assurance  to  parties  inside 
and  outside  the  Department  of  Defense,  that  DoD  auditors  comply  with  generally 
accepted  auditing  standards,  policies,  and  procedures.  The  quality  assurance 
program  shall  incorporate  the  following  elements; 

a.  Supervision .  The  DoD  internal  audit  organizations  shall  establish 
a  supervisory  process  which  ensures  audits  are  planned  and  completed  in 
accordance  with  generally  accepted  government  auditing  standards  and  DoD 
internal  auditing  standards.  The  supervision  process  shall  ensure  that  audit 
work  is  supported  by  clear,  demonstrable,  and  objective  evidence  that  is 
documented  in  audit  working  papers. 

b.  Internal  Quality  Control  Reviews.  Each  DoD  internal  audit  organi¬ 
zation  shall  establish  procedures  to  evaluate  the  adequacy  and  effectiveness 
of  the  audit  organization's  policies  and  procedures,  and  to  determine  whether 
audit  work  meets  DoD  internal  auditing  standards  and  policy.  As  a  minimum, 
internal  audit  organizations  shall  periodically  conduct  management  reviews 

of  selected  audits,  organizational  functions,  or  processes  within  the  audit 
organizations,  and  issue  a  formal  report  which  specifically  addresses  each 
review  objective.  Recommendations  in  the  report  shall  be  tracked  until  fully 
implemented  or  otherwise  satisfactorily  resolved.  Working  papers  shall  be 
prepared  and  retained  to  document  all  aspects  of  the  internal  quality  control 
program  and  shall  be  made  available  for  review  by  an  external  quality  assurance 
review  team. 

c.  External  Quality  Assurance  Reviews.  Quality  assurance  reviews  of 
the  DoD  internal  audit  activities  shall  normally  be  conducted  by  the  Office  of 
the  Assistant  Inspector  General  for  Audit  Policy  and  Oversight,  OIG,  DoD,  with 
the  assistance  of  representatives  from  the  DoD  internal  audit  organizations. 

The  DoD  internal  audit  activities  shall  conduct  quality  assurance  reviews  of 
the  internal  review  and  military  exchange  audit  activities  for  which  they  have 
audit  cognizance.  Generally,  OIG,  DoD,  will  limit  its  external  quality  assurance 
reviews  of  internal  review  and  military  exchange  audit  activities  to  assessing 
how  well  the  internal  audit  activities  carried  out  their  external  reviews. 
Quality  assurance  reviews  shall  evaluate  whether  the  DoD  internal  audit 
organization  operates  in  an  economical,  efficient  and  effective  manner  and 
adheres  to  generally  accepted  government  and  DoD  internal  auditing  standards. 


DoD  7600. 7-M 


policies  and  procedures.  The  final  report  on  the  quality  assurance  review 
shall  be  issued  to  the  head  of  the  audit  organization  reviewed,  and  to  the 
IG,  DoD.  The  DoD  internal  audit  organizations  shall  cooperate  fully  with 
the  quality  assurance  review  team  and  respond  promptly  to  all  requests  for 
information  from  the  team. 

d.  The  following  sections  elaborate  on  each  of  the  three  essential 
elements  described  above,  and  provide  suggested  guidelines  and  criteria  for 
incorporating  their  use  into  an  overall  quality  assurance  program. 

E.  SUPERVISION 

Supervision  is  the  first  step  in  a  quality  assurance  program  and  it  is 
a  continuing  process  on  all  audit  assignments  within  an  audit  organization. 
Responsibility  for  all  audits  remains  with  the  head  of  the  audit  organization. 
However,  the  head  of  the  audit  organization  may  delegate  audit  tasks  to  audit 
managers  or  supervisors,  who  in  turn  may  delegate  these  tasks  to  audit  teams. 
Delegation  requires  that  audit  managers  at  all  levels  establish  methods  that 
ensure  audit  assignments  are  planned,  controlled,  and  directed  properly.  The 
degree  of  control  may  vary  among  audit  organizations  and  audit  assignments. 

1.  Proper  supervision  of  audit  assignments  is  the  most  important  element 

of  an  effective  quality  assurance  program.  To  supervise  effectively,  supervisors 
should  be  involved  in  every  phase  of  the  audit,  from  planning  to  the  final 
report.  Supervisors  should  make  sure  auditors  understand,  without  ambiguity, 
the  nature,  scope,  content,  and  timing  of  the  work  assigned  to  them  and  the 
expected  end  product.  Supervisors  should  review  progress  periodically  on  audit 
projects  to  determine  whether  jobs  are  on  schedule  and  executed  in  accordance 
with  plans.  Supervision  should  be  sufficient  to  make  any  required  mid-course 
corrections  without  disrupting  the  audit  assignment. 

2.  The  actual  amount  of  supervision  required  may  vary  based  on  avail¬ 
ability  of  resources,  complexity  and  sensitivity  of  audit  work,  and  staff 
experience.  However,  supervision  should  be  exercised  at  each  level  of  the 
organization  and  for  each  level  of  task  responsibility.  Most  audit  assignments 
include  the  following  phases:  interaction,  planning,  survey,  audit  performance 
or  application,  and  reporting.  During  these  phases,  supervisors  should 
concentrate  on  the  following: 

a.  Interaction.  To  ensure  quality  audit  performance  and  efficient  use 
of  resources,  supervisors  should  be  aware  of  other  audit  projects  within  the 
audit  organization  and  in  other  Federal  audit  activities.  Supervisors  should 
maintain  open  lines  of  communication  with  the  headquarters  of  the  audit 
organization  and  with  other  field  offices  in  the  organization.  The  objective 
of  open  communication  is  to  reduce  the  overlap  of  audit  projects  and  enhance 
the  quality  of  audits.  Supervisors  should  share  ideas  on  audit  design,  audit 
planning,  audit  survey  scope  and  techniques,  audit  objectives,  audit  approaches, 
training  needs  and  audit  workload. 

b.  Planning.  Supervisors  should  establish  the  overall  direction  of 
the  audit  effort;  determine  the  best  use  of  available  resources;  establish 
goals  and  objectives  for  audits  that  make  sure  programs,  activities,  and 
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segments  of  agency  operations  are  covered  adequately;  and  coordinate  audit 
effort  with  review  efforts  of  other  activities  such  as  the  military  inspector 
general  offices. 

c.  Survey.  Supervisors  should  approve  the  survey  approach,  estimate 
time  required  for  the  survey,  and  establish  milestones  for  review  of  survey 
results . 

d.  Program.  After  reviewing  survey  results,  supervisors  should  set 
overall  objectives,  identify  the  steps  or  segments  requiring  further  audit 
work,  and  determine  any  program  modifications  needed  to  fulfill  the  audit 
objectives.  Supervisors  should  also  estimate  the  time  required  for  the  detailed 
audit  review  and  establish  milestones  for  review  of  the  program  development. 

e .  Audit  Performance 

(1)  Project  Reviews.  Supervisors  should  review  audit  projects 
periodically  to  make  sure  they  meet  DoD  internal  auditing  standards. 

Supervisors  should  use  onsite  visits  to  assist  in  project  management,  solve 
specific  problems  during  audit  application,  provide  technical  assistance, 
counsel  and  train  audit  team  members,  and  review  overall  management  of  the 
audit . 

(2)  Reviews  of  Working  Papers.  Supervisory  reviews  of  audit 
working  papers  are  essential  to  ensure  reports  are  supported  with  clear, 
demonstrable,  and  objective  evidence.  These  reviews  can  be  tailored  to  the 
particular  situation  and  individual,  but  should  provide  enough  information 
to  supervise  projects  properly  and  to  evaluate  staff  performance.  Problems 
discovered  during  working  paper  reviews  should  be  discussed  and  resolved 
promptly;  working  papers  should  be  revised  to  preclude  any  misinterpretation 
or  unsupported  conclusions.  Working  papers  should  be  reviewed  periodically 
throughout  the  audit.  All  supervisory  reviews  of  working  papers  should  be 
documented  and  retained.  Chapter  8  of  this  manual  prescribes  additional 
guidance  on  the  preparation  and  review  of  audit  working  papers. 

f.  Reporting .  Auditors  should  prepare  a  report  outline  and  discuss 
preparation  of  the  initial  draft  report  with  their  supervisor.  First-level 
supervisors  should  review  the  draft  audit  report  and  second-level  supervisors 
review  comments  and  the  results  of  any  discussions  with  management  concerning 
the  audit  results.  Based  on  these  reviews  the  second-level  supervisor 
finalizes  the  draft  audit  report,  making  sure  the  audit  report  complies 

with  the  DoD  internal  auditing  standards  on  reporting. 

F.  INTERNAL  QUALITY  CONTROL  REVIEWS 

Quality  control  reviews,  the  second  step  in  an  effective  quality  assurance 
program,  are  periodic  reviews  of  selected  audits,  organizational  functions, 
or  internal  processes,  conducted  by  an  independent  element  within  the  audit 
organization.  During  the  quality  control  review,  an  in-house  team  evaluates 
the  adequacy  and  effectiveness  of  the  audit  organization's  policies  and  proce¬ 
dures,  and  determines  whether  the  audit  work  meets  DoD  internal  auditing 
standards  and  policy.  During  a  typical  quality  control  review,  the  review 
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team  visits  the  applicable  directorate,  division,  region,  field  office  or 
resident  office.  Other  audit  sites  may  be  visited,  depending  on  the  scope 
of  the  review.  During  the  visits,  the  review  team  forms  an  overall  opinion 
of  the  adequacy  of  the  area(s)  being  reviewed  and  determines  whether  improve¬ 
ments  are  necessary. 

1.  Each  audit  organization  should  establish  policies,  procedures,  and 
plans  for  accomplishing  quality  control  reviews.  Each  major  element  of  the 
audit  organization  should  receive  a  quality  control  review  at  least  once  every 
3  years.  Major  elements  include  divisions,  regions,  large  field  offices  or 
residencies.  As  an  alternative,  selected  functional  areas  may  be  reviewed 

on  an  across-the-board  or  agency-wide  basis,  provided  there  is  representation 
given  to  the  various  elements  within  the  organization.  The  quality  control 
review  should  emphasize  matters  relating  to  the  accomplishment  of  audit  pro¬ 
jects;  that  is,  preplanning,  survey,  and  field  work,  including  preparation 
of  working  papers  and  reporting. 

2.  Quality  control  review  techniques  should  be  tailored  to  meet  the 
specific  situation.  A  review  may  include  all  functional  elements  of  an 
organization,  only  one  element,  or  several  elements  at  one  time. 

3.  The  audit  organization  may  use  several  teams  or  a  permanent  quality 
control  staff  to  fulfill  the  quality  control  requirement.  When  selecting  a 
staffing  alternative,  the  audit  organizations  should  consider  the  qualifi¬ 
cations  needed  to  accomplish  the  review,  composition  and  size  of  the  team, 
training  and  continuity  of  reviews,  independence,  and  geographical  and  travel 
constraints . 

4.  The  quality  control  review  team  should  adhere  to  DoD  internal  auditing 
standards.  The  team  should  document  all  conditions  found  during  the  review 
process  and  issue  a  formal  report  that  specifically  addresses  each  review 
objective.  The  report  should  recommend  corrective  actions,  when  appropriate; 
include  comments  from  the  organizational  elements  reviewed  followed  by  an 
evaluation  of  the  comment  by  the  quality  control  review  team;  and  establish 
target  dates  for  implementation.  Recommendations  should  be  tracked  until  fully 
implemented  or  otherwise  satisfactorily  resolved.  When  significant  deficiencies 
are  identified,  a  followup  review  may  be  appropriate  to  determine  that  adequate 
corrective  actions  were  taken. 

5.  All  working  papers  and  reports  of  internal  quality  control  reviews 
should  be  retained  for  3  years  for  use  by  external  quality  assurance  review 
teams . 


G.  EXTERNAL  QUALITY  ASSURANCE  REVIEWS 

Quality  assurance  reviews  are  similar  to  quality  control  reviews,  but  they 
are  conducted  by  groups  external  to  the  audit  organization.  Within  the 
Department  of  Defense,  quality  assurance  reviews  of  internal  audit  activities 
will  normally  be  conducted  by  the  Office  of  the  Assistant  Inspector  General  for 
Audit  Policy  and  Oversight,  OIG,  DoD,  with  the  assistance  of  representatives 
from  the  DoD  internal  audit  or  internal  review  activities.  The  DoD  internal 
audit  activities,  using  guidelines  published  by  OIG,  DoD,  are  responsible  for 
quality  assurance  reviews  of  the  internal  review  and  military  exchange  audit 
activities  for  which  they  have  audit  cognizance.  Occasionally,  however,  the  GAO 
may  conduct  similar  quality  assurance  reviews  of  DoD  audit  organizations. 
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1.  The  objectives  of  the  external  quality  assurance  reviews  are  to  ensure 
DoD  audit  organizations  adhere  to  DoD  internal  auditing  standards,  policies, 
and  procedures,  and  operate  in  an  economical,  efficient,  and  effective  manner. 

2.  Generally  accepted  auditing  standards  should  be  used  in  conducting 
these  quality  assurance  reviews,  in  the  same  manner  used  in  performing  any 
audit.  In  particular,  the  team  leader  of  the  review  should  observe  the 
requirement  for  holding  entrance  and  exit  conferences,  and  discussing 
periodically  the  progress  of  the  review  with  appropriate  managers  in  the 
audit  organization. 


3.  Quality  assurance  review  team  members  should  be  selected  based  on  the 
requirements  of  a  particular  review.  Functional  experts  from  inside  and  outside 
DoD  may  augment  the  quality  assurance  teams  in  certain  specialized  or  technical 
areas.  The  staff  members  nominated  for  the  quality  assurance  review  team 
should  not  have  been  associated  in  the  past  2  years  with  the  organization 
subject  to  review. 

4.  Before  starting  a  quality  assurance  review,  the  review  team  should 
collect  background  information  about  the  audit  organization,  including  its 
organizational  environment  and  governing  policies  and  procedures.  The  review 
team  is  encouraged  to  use  questionnaires  to  gather  background  data,  identify 
related  audit  policies  and  procedures,  obtain  opinions  of  the  audit  staff  on 
policies  and  procedures  used  by  the  audit  organization,  and  solicit  opinions  of 
auditees  regarding  the  relationships  of  the  audit  organization  and  its  clients. 
The  DoD  internal  audit  and  internal  review  activities  should  respond  promptly 
to  all  requests  for  information  from  the  quality  assurance  review  team. 

5.  Quality  assurance  reviews  should  be  conducted  on  a  recurring  schedule 
and  normally  should  include  each  audit  organization  at  least  once  every  3 
years.  As  with  any  audit,  the  scope,  objectives,  and  work  program  of  the 
quality  assurance  review  should  be  tailored  to  meet  specific  situations. 
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CHAPTER  17 

DOD  INTERNAL  AUDIT  POLICY  ADVISORY  GROUP 


A .  PURPOSE 


This  chapter  establishes  a  permanent  internal  audit  policy  advisory  group 
to  advise  the  IG,  DoD,  on  internal  audit  policy  matters  within  the  Department 
of  Defense. 

B.  APPLICABILITY 


This  chapter  applies  to  all  DoD  audit  organizations,  including  internal 
audit,  internal  review,  and  military  exchange  audit  activities. 

C.  POLICY 

1.  Under  DoD  Directive  5106.1,  "Inspector  General  of  the  Department  of 
Defense"  (reference  (o)),  the  IG,  DoD,  is  responsible  for  providing  policy 
direction  for  internal  audits  of  DoD  programs  and  operations.  Current  DoD 
policies  on  internal  auditing  are  contained  in  DoD  Directive  7600.2, 

(reference  (h)),  DoD  Instructions  7600.3,  7600.5  and  7600.6,,  (reference  (p), 
(q),  (r))  and  in  other  chapters  of  this  manual. 

2.  The  Internal  Audit  Policy  Advisory  Group  shall  provide  advice  and 
assistance  to  the  IG,  DoD,  on  internal  audit  policy  within  the  Department  of 
Defense . 

D.  ADVISORY  GROUP  MEMBERSHIP 

1.  The  chairperson  of  the  advisory  group  shall  be  the  Deputy  Assistant 
Inspector  General  for  Internal  Audit  Policy  and  Oversight,  OIG,  DoD, 

(DAIG-APO) .  Members  of  the  Inspector  General's  audit  policy  staff  will  assist 
in  presenting  issues  of  current  interest  to  the  advisory  group. 

2.  In  addition  to  the  DAIG-APO,  each  member  organization  shall  appoint  a 
representative  to  the  advisory  group  who  has  direct  access  to  the  head  of  their 
audit  organization.  Each  organization  shall  designate  a  primary  member  and  an 
alternate,  and  shall  notify  the  chairperson,  in  writing,  whenever  the  primary 
or  alternate  representatives  change.  A  representative  from  the  Office  of  the 
Assistant  Inspector  General  for  Criminal  Investigations  Policy  and  Oversight 
(OAIG-CIPO) ,  OIG,  DoD,  shall  be  a  member  of  the  group  and  provide  advice  on 
matters  involving  the  interface  between  audit  and  investigation.  The  following 
organizations  shall  be  represented  on  the  advisory  group; 

a.  OAIG-AUD,  OIG,  DoD. 

b.  Army  Audit  Agency. 

c.  Naval  Audit  Service. 

d.  Air  Force  Audit  Agency. 

e.  Army  and  Air  Force  Exchange  Service 

f.  Navy  Resale  and  Services  Support  Office. 

g.  Marine  Corps  Exchange  Service. 

h.  Army  Internal  Review. 

i.  Navy  Internal  Review. 


j .  Marine  Corps  Internal  Review. 

k.  Defense  Logistics  Agency  Internal  Review. 

E.  ADVISORY  GROUP  RESPONSIBILITIES 

The  policy  group  shall  advise  the  IG,  DoD,  on  all  aspects  of  internal 
audit  policy,  and  make  recommendations  for  changes  in  those  policies.  Policy 
issues  include,  but  are  not  limited  to,  management  of  audit  organizations; 
technical  audit  standards;  audit  training  and  career  development;  and  relation¬ 
ships  with  DoD  managers,  civilian  professional  associations,  and  other  Federal 
agencies.  The  chairperson  shall  attempt  to  provide  the  members  of  the  advisory 
group  with  an  opportunity  to  comment  on  major  audit  issues  being  considered  by 
the  OIG,  DoD,  during  the  policy  formulation  process.  Proposed  draft  audit 
policy  documents  generally  will  be  forwarded  to  advisory  group  members  of  the 
various  audit  organizations  for  their  comments  and  suggestions  before  official 
staffing  of  the  documents  with  OSD,  the  Military  Departments,  and  the  Defense 
Agencies . 

F.  MEETINGS 

The  advisory  group  shall  convene  quarterly,  or  when  determined  to  be 
necessary  by  the  chairperson.  An  agenda  generally  shall  be  published  in 
advance  of  meetings  and  representatives  shall  be  given  an  opportunity  to  add 
topics  or  suggest  changes  to  the  agenda.  Minutes  shall  be  kept  to  ensure  a 
record  of  important  discussions  and  confirm  agreements  on  any  taskings. 
Distribution  of  the  minutes  shall  be  made  to  advisory  group  members  before 
the  next  meeting. 


EXPANDED  DEFINITION  OF  MATERIAL  WEAKNESS  IN 
THE  INTERNAL  CONTROLS  OF  THE  DEPARTMENT  OF  DEFENSE 


A  material  weakness  in  DoD's  system  of  internal  controls  may  be  due  to 
lack  of  an  appropriate  control,  or  more  frequently,  inadequate  compliance  with 
existing  controls.  These  controls  deal  with  all  program  and  administrative 
functions;  they  are  not  limited  to  financial  or  accounting  matters.  Regardless 
of  what  level  a  weakness  in  internal  controls  occurs  within  the  Department  of 
Defense,  the  Office  of  the  Assistant  Secretary  of  Defense  (Comptroller)  lists 
the  following  factors  and  examples  for  consideration  in  classifying  or  reporting 
a  weakness  as  material: 

o  Impairs  fulfillment  of  mission, 

o  Violates  statuthry  or  regulatory  requirements, 

o  Deprives  the  public  of  needed  Government  services, 
o  Results  in  adverse  publicity  or  embarrassment, 
o  Diminishes  credibility  or  reputation, 
o  Endangers  national  security. 

o  Leads  to  waste  or  loss  of  funds,  property,  or  other  resources, 
o  Allows  fraud  or  other  criminal  activity  to  go  undetected, 

o  Causes  harm,  even  though  minor  individually,  because  they 

are  extensive  in  the  aggregate. 

o  Causes  loss  of  control  over  5  percent  or  more  of  the  resources 
for  which  an  organization  is  responsible. 

Because  of  the  size  and  diversity  of  the  Department  of  Defense  and  its 
Component  organizations,  material  weaknesses  are  to  be  considered  at  four 
levels : 

1.  DoD  Level. 

2.  Component  Level. 

3.  Major  Command  or  Field  Activity  Level. 

4.  Installation  or  Activity  Level. 

Listed  below  are  some  specific  examples  of  the  above  factors  applied 
at  each  of  the  four  levels: 

DoD  LEVEL 

(At  the  DoD  level,  a  material  weakness  includes  a  problem  that  appears 
in  several  components,  amounts  to  $2  million  or  more,  or  may  be  national  or 
international  in  scope.  However,  depending  on  the  effect  or  impact  of  the 
problem,  a  less  extensive  problem  could  be  of  concern  to  the  Secretary  of 
Defense . ) 

o  Breakdowns  in  supply  or  repair  policies  and 

practices  which  result  in  too  few  ships,  planes, 
vehicles,  or  weapons  to  accomplish  intended 
missions . 
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Failure  to  observe  controls  over  expenditure  of 
funds  within  appropriation  limits. 

Poor  medical  care  caused  by  inadequate  procedures 
or  insufficient  resources. 

Overpriced  components  of  weapons  systems  (waste 
cans,  toilet  seat  covers),  or  inappropriate  over¬ 
head  charges  being  tolerated  from  contractors. 

Inadequate  control  over  transfer  of  technology  to 
foreign  governments. 

Insufficient  attention  to  control  over  travel 
advances,  or  over  interest  penalty  payments; 
small  at  each  location,  but  pervasive  throughout 
the  Department  of  Defense. 

COMPONENT  LEVEL 


(At  the  Component  level,  a  recommended  threshold  for  monetary  problems  in 
the  larger  Components  is  $250,000.  For  small  Defense  Agencies,  lesser  thresholds 
may  be  appropriate.) 

o  Problems  which  amount  to  losses  of  less  than  $250,000, 
but  which  are  pervasive,  chronic,  or  constant. 

o  Using  funds  from  operations  appropriations  for 
procurement  or  construction  purposes. 

o  Using  systems  which  do  not  conform  with  GAO 
principles  and  standards. 

o  Inadequate  control  over  access  to  records 
in  computer  data  bases. 

o  Improper  practices  in  acquiring  and  maintaining 
computer  equipment. 

o  Failure  to  collect  on  debts  owed  the  Government 
before  members  separate  from  service. 

o  Poor  control  over  property  on  hand  or  over 
property  turned  in  as  excess. 

MAJOR  COMMAND/FIELD  ACTIVITY  LEVEL 

o  Inadequate  control  over  maintenance  versus 
new  construction  decisions. 

o  Weaknesses  in  payroll  practices. 

o  Weaknesses  in  control  over  temporary  duty  travel. 
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INSTALLATION/ACTIVITY  LEVEL 

Inadequate  performance  by  contracting  officer 
representatives  in  user  offices. 

Failure  to  comply  with  controls  over  weapons, 
ammunition,  or  property. 

Poor  procedures  for  processing  personnel  on  or 
off  base. 


, 


o  Improper  use  of  facilities  or  equipment. 

o  Breakdown  in  controls  allowing  fraudulent  actions 
in  morale,  welfare,  or  recreation  activities. 

The  0MB,  in  its  question  and  answer  booklet  dealing  with  the  Federal 
Managers'  Financial  Integrity  Act  and  Circular  A-123  (reference  (j)  and  (k)), 
provided  the  following  guidance  in  reporting  material  weaknesses: 

o  The  material  weaknesses  included  in  the  report  to 
the  President  and  the  Congress  should  consist  of 
matters  of  significance  to  the  President  and’ the 
Congress . 

o  Assurance  letters  at  other  levels  in  an  agency  or 
organization  probably  will  disclose  weaknesses  of 
varying  degrees  of  significance  to  the  agency  as 
a  whole.  The  recipient  of  the  assurance  letters 
at  each  level  should  collect  and  analyze  those 
crosscutting  weaknesses  or  items  common  to  several 
units  and  other  weaknesses  of  significance  and 
consider  whether  they  are  appropriate  for  inclusion 
in  the  assurance  letter  to  the  next  higher  level 
official . 
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